Pistonlog uses custom cookie sessions for the web app and Bearer tokens for the mobile app. The two have different lifetimes because the security trade-offs are different.
How long sessions last
| Transport | Duration | Why |
|---|---|---|
| Web cookie | 12 hours | A shared workshop computer shouldn't stay logged in overnight |
| Mobile Bearer | 30 days | A technician's personal phone is locked behind a passcode; less risk of misuse |
These limits are deliberate. If your session expires you'll be redirected to the login page and any in-flight work — except line-item edits — will have been saved already.
What happens at expiry
- Web: a request after expiry gets a 401, the app redirects to
/loginwith a "session expired" message. After signing back in you land on your default landing page. - Mobile: the app asks you to sign in again with your email address and password, the same credentials you use on the web app.
Multi-device
Pistonlog keeps one live web session and one live mobile session per person.
Sign in on a second browser (a different computer, a different browser on the same computer, or a private window) and the first one is signed out. The next thing you do in that older tab shows a "signed in elsewhere" message and sends you back to the login page. Nothing is lost that was already saved, but it does mean a desktop and a tablet cannot be signed in to the same account at the same time.
Web and mobile do not affect each other. Signing in on your phone leaves your web session alone, and signing in on a computer leaves the phone alone.
Two people, two logins
If two people need to be in Pistonlog at once, give them a login each. Sharing one account means each sign-in kicks the other person out. See Team management.
When to log out manually
- Shared workshop computer — log out at the end of the day even though the cookie would expire automatically. Nothing wrong with belt-and-braces.
- Personal phone you're getting rid of — log out before factory-resetting or selling.
- Suspected unauthorised access — change your password from your profile, then sign in again. Because only one web and one mobile session can be live at a time, signing in yourself also displaces whoever else was signed in as you.
Two-factor authentication
Pistonlog doesn't yet support 2FA. If your team handles particularly sensitive data, ask in support — it's on the list of upcoming security improvements.