Harness sessions
The people and machines logged in to an agent from a coding harness, and how to revoke a machine, a consent or block a person.
The Harness sessions tab of an agent lists the people who logged in to it from a coding harness (Connect a coding harness). Each login on one computer is a machine: it has its own refresh token and can be revoked alone.
The summary at the top counts them: "{N} people · {M} machines". Only active consents and machines are listed.
A person
Each person has a card with the name, the subject, "via group {group}" (the group that made them eligible at login) and "consent ends {date}". Two actions:
- Revoke consent ends the consent of the person and all of their machines. The person can log in again and consent again while they are in an eligible group.
- Block adds the person to the blocked list of the draft, next to the other unsaved edits of the agent: "{name} blocked in the draft. Publish to revoke their machines and stop new logins." After publication, the person cannot log in to the agent again until someone unblocks them (Who can delegate).
A machine
Each machine is one row under its person:
| Element | What it shows |
|---|---|
| Name | The harness name, from its client metadata document |
| Logged in · used | When the login happened and when the machine last got a token |
| Bound to device or Bearer | Whether the tokens are bound to a key of the harness with DPoP, or plain bearer tokens |
| Revoke | Ends this machine only. Its refresh token stops working at once, and its access token is refused on the next call |
Without logins, the tab says "Nobody is logged in from a harness."
When a machine ends by itself
A machine also ends without anyone acting:
- after 24 hours without a refresh;
- when its consent ends;
- when its refresh token or authorization code is used twice (
refresh_reuse,code_reusein Investigate); - when harness login is turned off in the identity connection, or the connection is disabled: refreshes stop, and the access tokens end within 5 minutes.
A refresh does not reach the identity provider. A person disabled in the provider, or removed from the group, keeps the machine until one of the limits above. Block the person to cut access at once (Revocation).