List sessions

GET /fapi/v1/me/sessions · called from the environment's sign-in host

Returns the authenticated user's active sessions, most recently seen first. The session making the request has current: true. Requires the authenticated user's __Host-idp_session cookie; if the cookie is missing, expired, or revoked, returns 401 unauthenticated. A first-party app on another origin can instead send its front API access token (Authorization: DPoP <token> with a DPoP proof; see Front API access token). No recent re-verification is needed.

Request

Headers:

Header Required Description
Idp-Client yes SDK identifier.

No body.

Response

200 OK:

Field Type Description
data[].id string Session identifier (ses_…).
data[].current boolean Whether this is the session making the request.
data[].login_host string Sign-in host the session was opened on.
data[].browser_family string Browser family, when known.
data[].os_family string Operating system family, when known.
data[].device_type string Device type, when known.
data[].country string Country the session was opened from (ISO 3166-1 alpha-2), when known.
data[].ip_address string Last seen IP address, else the one the session was opened from; absent once retention has cleared it. Shown only to the user themselves.
data[].created_at string When the session was opened (RFC 3339, UTC).
data[].last_seen_at string When the session was last used (RFC 3339, UTC). 
{
  "data": [
    {
      "id": "ses_01jbz6x8kq3m2n4p5r6s7t8v9w",
      "current": true,
      "login_host": "example.keenauth.app",
      "browser_family": "firefox",
      "os_family": "linux",
      "device_type": "desktop",
      "country": "DE",
      "ip_address": "192.0.2.10",
      "created_at": "2026-10-01T09:30:00Z",
      "last_seen_at": "2026-10-12T08:15:00Z"
    }
  ]
}

Errors

Status Code When
401 unauthenticated No valid session cookie.

Example

curl https://example.keenauth.app/fapi/v1/me/sessions \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -b cookies.txt

Personal data

This endpoint carries personal data: sessions. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.