What happens to a trader's session when I rotate the password?
Quick answer
Rotating a password generates a new one and revokes every session for that account, so the old password and every existing login stop working. Because terminal access tokens are short-lived, an already-open terminal loses access within at most 15 minutes, when it next needs to refresh. The trader then logs in with the new password.
Detailed answer
Rotation is the main way to cut off access to an account.
What happens immediately
- A new password is generated and shown in the admin panel.
- Every session's refresh token for the account is revoked.
- The old password no longer logs in.
What happens to an open terminal
Each session uses a short-lived access token, valid for up to 15 minutes, which is checked by its signature. When it expires, the terminal tries to refresh it, the refresh is refused, and the trader is signed out. So an open terminal can continue for at most 15 minutes after rotation.
Other actions that revoke sessions
- Reassigning the account to another trader.
- Unassigning it.
- Archiving it.
When to rotate
- When an account changes hands.
- When a password or login link may have been shared.
- When a trader reports suspicious access.
Over the API
POST /v1/accounts/{account}/credentials/rotate does the same, for firms that automate account handovers.
PropExecutor team · Updated
Related questions
All 26 questions in The PropExecutor trading terminal · Every category