Sign Out & Revoke Access

Sign out of Starfire AI, revoke specific sessions, review device access, and understand what is not revoked automatically.

Sign out & revoke access

Signing out and revoking access are related but not identical actions.

Sign out of the current client

Use the normal sign-out action when you are finished on the current device. This ends the current interactive session according to the active session model.

Revoke another session

If Starfire exposes session/device management:

1. Open account security or Sessions & Devices.
2. Identify the session you no longer trust.
3. Revoke that session.
4. Confirm it is no longer active.

Revoke broadly

After a lost device or suspected compromise, you may need to revoke multiple sessions rather than only the current browser.

Authorized platform administrators can also revoke sessions when the user cannot safely do so themselves.

What session revocation does not automatically remove

Review these independently when relevant:

• API keys
• service-account credentials
• webhook secrets
• external integration tokens
• organization-owned developer applications

Those are programmatic credentials, not browser sessions.

Organization offboarding

Removing a person from an organization should also be treated separately from signing them out of Starfire entirely. Organization membership controls team resources; sessions control authentication to the account.

If a credential is known or suspected to be exposed, revoke that credential directly. Signing out of the web app is not a substitute for API-key rotation.

Developer security

Review programmatic credentials separately from interactive account sessions.