# Security

Canonical HTML: https://anchorshell.com/docs/security/

Change your password and remove access from sessions you no longer recognize.

Last updated: 2026-09-17

Sessions represent signed-in browsers, independently of application API keys. Revoke an unfamiliar session to stop its dashboard access; revoke a key separately when an application should lose access.

## Dashboard

1. Open **Account → Security**.
2. For a password account, use **Change password**.
3. Review **Sessions**.
4. Click **Revoke** beside a session you do not recognize.
5. Review **Account → Activity** for recent account actions.

Changing your password signs out your other sessions. Password reset signs out existing sessions. Accounts created with a login provider manage their password with that provider.

## API

Use an appropriately scoped [API key](https://anchorshell.com/docs/api) for these requests.

### List your sessions

```bash
curl 'https://api.anchorshell.com/api/account/sessions' \
  -H 'Authorization: Bearer <API_KEY>'
```

**Response — 200 OK**

Selected response fields shown; IDs and values are illustrative.

```json
{
  "sessions": [
    {
      "id": "<SESSION_ID>",
      "current": false,
      "browser": "Chrome",
      "os": "macOS",
      "device": "Desktop"
    }
  ]
}
```

### Revoke a session

```bash
curl -X DELETE 'https://api.anchorshell.com/api/account/sessions/<SESSION_ID>' \
  -H 'Authorization: Bearer <API_KEY>'
```

**Response — 204 No Content**

No response body.

These operations require `cloud:account:manage`. Password changes and browser logout require an authenticated browser session; password recovery uses the existing email flow.

## Next

[API Keys](https://anchorshell.com/docs/api-keys).