Users & Sessions
What an Abrova Auth user is, how a session works (1-hour access token, rotating refresh token with reuse detection), how the SDK renews it, and how sign-out, sign-out everywhere and disabled users end it.
An Abrova Auth user belongs to one project and has a random id. A session is what keeps that user signed in on one device: a short-lived access token for Abrova products and a long-lived refresh token the SDK trades for new access tokens.
Users#
Each user has an id like ru_4fK9xQ2mB7nT1pLz8RcV3w: ru_ and 22 random letters and digits. The id never contains an e-mail, a phone number or an Apple or Google account id, so it is safe to store in your data and show in logs.
- One project, one user list. The same person in two of your projects is two unrelated users. A user of one project can never sign in to another.
- Several ways in, one user. A user can have more than one sign-in method linked (for example anonymous, then Apple, then a password). The id stays the same. See Anonymous users & upgrading.
- No automatic merge by e-mail. An Apple account and a Google account with the same e-mail are two users, unless the user links them on purpose. Merging by e-mail is a known way to take over accounts.
The SDKs return the user as:
| Field | Meaning |
|---|---|
| id | The user id (ru_...). Use it as the user id everywhere in your app. |
| anonymous | True until the user links Apple, Google or a password. |
| emailVerified | True once the user proved the e-mail address (verification link, magic link, password reset, or a verified Google e-mail). |
| createdAt | When the user was created. |
| providers | Linked sign-in methods, for example apple, google, password. |
Sessions#
Every sign-in starts a session on that device. A session has two tokens:
| Access token | Refresh token | |
|---|---|---|
| What it is | The Abrova user token (a signed JWT) | A random value with no meaning of its own |
| Lifetime | 1 hour | 60 days from its last use, at most 1 year from sign-in |
| Kept on the device | In memory | In secure storage (Keychain, Android Keystore-backed storage, or what you choose on the web) |
| Kept by Abrova | Nothing: it is checked by its signature | Only a hash of it |
| Sent to | Every Abrova product | Abrova Auth only |
A user who opens the app at least once every 60 days stays signed in for up to a year. After a year, or after 60 days without the app, the user signs in again.
The access token
The access token is the standard Abrova user token. Abrova Sync, Chat, Push, A/B Testing and Storage verify its signature and read the user from it, so you never pass a user id to them yourself. It carries:
| Claim | Value |
|---|---|
| sub | The user id (ru_...). This is auth.uid in Sync security rules. |
| pid | Your project. A token of another project is refused everywhere. |
| exp | One hour after it was issued. |
| amr | How the user signed in: anonymous, apple, google, password, magic_link or telegram. |
Renewal
You do not renew tokens yourself. The SDK keeps the access token, and when an Abrova SDK (or your code) asks for it, the SDK returns it while it has more than 2 minutes left and renews it otherwise. Several callers asking at the same time share one renewal.
Every renewal returns a new refresh token and retires the old one. If a retired refresh token is ever used again, someone has copied it: Abrova Auth ends that whole session at once and records it in the activity log. The real user simply signs in again; the copy stops working. Simultaneous renewals from one app are handled safely.
Offline and network errors
A network error never signs the user out. The SDK keeps the session and tries again on the next request. The user is signed out only when Abrova Auth says the session is over.
Ending a session#
| What happens | Effect |
|---|---|
| signOut() | Ends the session on this device. Never fails: the device forgets the session even when it is offline. |
| signOutEverywhere() | Ends every session of the user, on every device. |
| deleteAccount() | Deletes the user and all its sessions. See Security & data. |
| Password reset | Ends every session of the user. The user signs in with the new password. |
| User disabled in the Console | Ends every session. Sign-in and renewal answer USER_DISABLED until you enable the user again. |
| Copied refresh token used | Ends that session (reuse detection). |
| 60 days unused, or 1 year old | The session expires. The next renewal answers SESSION_EXPIRED. |
When a session ends on the server, the SDK on that device notices at its next renewal, clears the session and tells your auth state listener (the user becomes null).
Access tokens are checked by their signature, not looked up. An access token that was issued before a sign-out everywhere, a disable or a deletion keeps working in other Abrova products until it expires, at most one hour later. Renewal is refused at once, so it cannot be extended.
In the Console#
Abrova Auth › Users lists your project's users with their sign-in methods, when they were created and when they were last active. From there you can disable or enable a user, sign them out everywhere, or delete them.