How long can a revoked session keep working?
Quick answer
Up to 15 minutes. Revoking a session (by rotating the password, reassigning or archiving the account) cancels its refresh token immediately, but the short-lived access token already in an open terminal stays valid until it expires, which is at most 15 minutes. New logins with the old password fail at once.
Detailed answer
This is a deliberate trade-off, stated openly.
Why tokens are not checked on every request
Access tokens are verified by their signature alone, without a database lookup, so every order and price request stays fast. The cost is that a revoked session is only fully closed when its access token expires.
Why 15 minutes
The access token's lifetime is short precisely because it bounds how long a revoked session can continue. A shorter lifetime would mean more frequent refreshes; a longer one would let revoked sessions trade longer.
What happens in those minutes
- The trader can continue trading in an already-open terminal.
- When the access token expires, the terminal tries to refresh, the refresh is refused, and the trader is signed out.
If you need trading to stop immediately
- Manual breach ends the account at once.
- Close positions from the admin panel.
Combine these with rotation when removing access urgently, for example after confirmed abuse.
PropExecutor team · Updated
Related questions
- The PropExecutor trading terminalWhat happens to a trader's session when I rotate the password?
- How are trader sessions secured?
- Managing accounts and tradersHow do I cut off a trader's access immediately?
- How are admin sign-ins protected?
- Managing accounts and tradersHow do I reassign an account to a different trader?
All 11 questions in Security, data and reliability · Every category