The panic button
One click to sign out every other device and cut every connected app’s access.
- 1
Sign in to the Demo app (P10) so you have at least one connected app.
Connecting an app remembers your consent and mints live access + refresh tokens for it — exactly the kind of standing access a real incident response has to account for, not just the login session.
- 2
On your account page, click “Revoke all access”.
One call fans out into the same primitives you’ve already used individually: every OTHER session is revoked, and every connected app’s grant, access token and refresh token are cut — the cascading revocation offboarding depends on.
- 3
Check the X-ray: your current session and account survive untouched.
This is a reversible safety action, not deprovisioning — log back in with your passkey and any app you revoked just asks for consent again. Nothing about your identity is deleted.
Do it
This one happens on your account page — register a passkey, revoke a session, or enroll TOTP there.
Go to your account →Learn the theory
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.