Sessions
WP admin: WP Admin → POS → Settings → Sessions.
Sessions shows who is signed in to the POS and on which devices, so you can sign out a lost tablet or a cashier who has left without touching the device.
Open it at WP Admin > POS > Settings > Sessions. Administrators and Shop Managers can use it. A Shop Manager sees everyone's sessions except an administrator's.
What counts as a session
Each time someone signs in to the POS, the store keeps a session for that device: one per sign-in in the desktop app, and usually one per browser for the POS in a browser.
Find a person's devices
The screen has two columns.
- People on the left. Everyone with at least one session you may manage. You're at the top with a You chip, then the rest by most recent activity. The number on each row is how many sessions that person has, and a green dot means Active now. A till can still be in use without the dot (see Last active). Type in Filter users to search by name or username.
- Their sessions on the right. Select a person to see their name, their username and how many sessions they have, the Logout All button, and one card per device, the most recent first. Read a session card explains what each card shows.
Sign a device out
Anyone who knows the password can sign straight back in.
- A cashier who has left: also remove their POS access in Access, or change their password.
- A lost or stolen device: change the password of each person who was signed in on it.
Neither the green dot nor Last active proves a till is idle. Check with the person before you sign it out.
Sign out one device
- Select the person on the left.
- Find the device by its Application, IP and Created time.
- Press Terminate on its card. Terminate session? asks you to confirm. Press Terminate.
Session terminated successfully confirms it, and the session leaves the list.
Sign out all of a person's devices
- Select the person on the left.
- Press Logout All. Terminate all sessions? asks you to confirm. Press Logout All.
Sessions terminated successfully confirms it, and their sessions leave the list.
What a password change does
It ends every POS session the person has, on every device, at once, and stops anyone signing back in with the old password. They sign in again with the new one on their other devices.
What happens on the device
The device's sign-in is cancelled straight away. The next time the POS connects to your store, it opens the WordPress sign-in window and shows Session expired: the same as when a sign-in runs out. See AUTH101.
Nothing on the device is wiped. Sales that haven't reached the store wait on the device and send once someone signs in again. On the Connect screen the person's row shows Sign in again. See Connect to your store.
Ending your own session from here signs your POS out, not WP Admin.
Read a session card
Three fields tell one device from another:
- Application: the kind of app the person signed in from, with its version: iOS Application, Android Application, Desktop Application or Web Application. Below it, the browser and the operating system.
- IP: the internet address the device signed in from, or N/A.
- Created: when the person signed in on that device.
Last active is when the device last signed in or renewed its sign-in, as Just now, 5 minutes ago or 3 hours ago. A POS in use renews about every 30 minutes.
Active now: a till can be in use without showing it. The green dot means the person signed in or renewed a sign-in in the last 5 minutes.
More session details: Expires and User Agent
- Expires is when the sign-in runs out and the person has to sign in again: 30 days after Created. Using the POS doesn't push it back.
- User Agent: press it to see the raw text the device sent. Support may ask for it.
Other ways a session ends
You don't have to clear sessions by hand. A session also ends when:
- it reaches Expires, 30 days after the sign-in;
- the person's password is changed or reset: every POS session they have ends;
- the person signs out of WordPress in a browser: the POS session in that browser ends, and their other devices stay signed in.
For developers: session length and the session limit
The 30 days come from the wcpos_jwt_refresh_token_expire filter, and the 30-minute renewal from wcpos_jwt_access_token_expire. See Token Expiry Coverage.
A person can hold up to 200 sessions. When a new sign-in would go over that, the store removes the sessions that have been idle longest, and only ones not seen for a week. A device in use is never removed this way.
If something goes wrong
No active sessions found. Nobody you can manage is signed in to the POS.
A person you expect isn't listed. They have no session that hasn't expired, or they are an administrator and you're signed in as a Shop Manager.
The device signed straight back in. Someone there still knows the password. Change it, or remove the person's POS access in Access.