Devices and tokens

Each sign-in is a device: a token named after the computer it was made on ("sign-in Sam's MacBook Pro").

• A token expires after 30 days without use; each use extends it.
• A token is rotated by its client once it is 7 days old. The old one keeps working for a day, for the client's other processes.
• The app keeps it in the macOS Keychain and never lets it into its web view. The CLI uses the OS keychain when one is available, otherwise a file only you can read, and never prints it.

Seeing and revoking

You can list your devices and sign any one of them out at once: in the app's Settings, or with

crewdesk devices
crewdesk devices revoke ID
crewdesk logout --everywhere   # every device of this account

Revoking a device stops a turn it is running at its next check.

When access ends

When an admin revokes a user, every token of theirs is revoked, their running turn ends, their AMP link and stored credentials are removed and their open invites are closed. See Users and invites.