signing out lost device

[Deliana90]

let's say our device got stolen, can we remove access those stolen device?

for example

• aws have this https://docs.amplify.aws/lib/auth/emailpassword/q/platform/js/#global-sign-out
• firebase have this https://firebase.google.com/docs/auth/admin/manage-sessions#revoke_refresh_tokens

[GaryAustin1]

Currently no built in way? (see 2nd part).

You could manually remove all refresh tokens for the uuid from the auth.refresh_tokens table. This means when there current jwt times out they can't refresh it. You could also write a function to do this based on email or something simpler than uuid as input. Probably also have to require a password reset.

It appears an option to temporarily ban a user is in the works: supabase/auth#343
Not clear on when that is part of the system (may already be) and no real documentation yet I could find.

Note in all cases someone with a current jwt can use that until time expires (default 1 hour)