paidAffiliate disclosure. The partner link in the masthead and in the bands beside the copy on this page is a sponsored link to a partner operator, and this site may be paid if you open an account through it, at no extra cost to you. It carries rel="sponsored noopener" and opens in a new tab. That matters on this desk in particular: the subject is what a device hands to an app and what a reader can refuse, and this site’s own revenue depends on a reader opening an account. No operator and no app is named, rated or recommended anywhere on this site.
The Handset / The session
Where the login lives
The session on the device
Staying signed in is a small file on the phone, not a favour from the operator. It has a life, a count per account, a revocation path, and a worst-case delay - and all four are worth knowing before a phone is lost.
App stub
- What is kept
- a session token, and nothing else that logs you in
- Life without an open
- 30 days, refreshed each time the app opens
- Devices at once
- 5, each with its own token
- Revocation
- each device separately, 0.4 minutes each
- Worst-case delay
- 15 minutes, until the app next calls the server
the promptA question the device asks once, and an answer you can change at any time
the tokenWhat keeps a phone signed in, and how long it lives without an open
the buildA numbered version of the app, and the only part of the product an update can change
Direct answerThe app keeps a session token on the device. On the sample it lives for 30 days of not being opened and is refreshed every time the app opens, so a phone that is used monthly stays signed in and a phone left in a drawer is signed out after a month. Five devices can hold a token at once, each can be revoked on its own, and a revocation takes effect the next time the app speaks to the server - at most 15 minutes.
Question how am I still signed in?Kept on the device a session token, per deviceLife 30 days without an open, refreshed on each openDevices at once 5Revocable yes, one device at a time, from the website or the app
The token, and its clock
token 01What the token is, and what it is not
It is not the password: the password is never stored on the phone, and it is not the account. It is a
credential that says "this device was signed in as this account", and its whole value to a thief is that it
works without the password. That is why the count of live tokens and the revocation path matter more than the
length of the token itself.
token 02The 30-day clock
The clock is idleness, not age. An open resets it, so the token of a device used daily never expires on
its own, while a device that is never opened is signed out after 30 days. The practical
consequence: a lost phone that nobody has opened the app on is not signed in for long, and a lost phone that
the player uses every day stays signed in until the token is revoked.
token 03Revoking one device, or all of them
Each device is listed separately, so a revocation can be surgical. Revoking one is one action; revoking
a full list of five is five, at about 0.4 minutes each, so 2.0 minutes of a bad
afternoon. After a revocation the phone is signed out the next time it calls the server, which on this sample
is within 15 minutes.
- The app opens and sends the stored token instead of a password.
- The server accepts or rejects it, and a rejection returns the app to the sign-in screen.
- On acceptance the token is refreshed, which resets its 30-day idle clock.
- If the token was revoked, the next call is where it stops - up to 15 minutes after the revocation.
A device table of 250 rows
accounts: 100
devices each: 2.5 on average
device rows: 250
rows whose token is dead: 12.0% = 30 rows
live rows: 220
A fifth of a small account table is devices that will never open the app again. The revoke
list does not distinguish them from the phone in a pocket.
The one action worth taking. If a phone is lost, revoke that device rather than changing the password alone: the password is not what the app is using.
Where this leads
Every figure on this page is derived from the sample app on the overview: 250,000 store views a month, 62,500 installs, 45,000 first opens, 5,400 registrations and 1,134 first deposits.
Open the partner account
What this desk does not do
It names no operator, it rates no app, and it recommends no store listing. The partner link beside this text is a disclosed sponsored link and the reason is stated on every page rather than in a footer.