Access & Identity
Session Management
Reviewed by Shalabh Agarwal · OTT & Streaming
Last updated: 2026-07-01
Session management controls a user's active login sessions across devices — issuing, refreshing, tracking, and revoking them. It keeps viewers signed in securely while enforcing device and concurrency limits and enabling clean sign-out everywhere.
Enveu take
Sessions are where security and convenience collide — too aggressive and you log paying users out mid-binge, too loose and one password ends up shared across a dozen homes.
AccessSecuritySessions
What it is
Session management handles the lifecycle of a login: issuing access and refresh tokens at sign-in, refreshing them so viewers stay logged in, tracking active sessions per device, and revoking them on sign-out, password change, or policy breach. In OTT it also feeds concurrency control and device management, and must handle long-lived sessions on TVs securely.
- Token issue, refresh, track, revoke
- Feeds concurrency and device limits
- Handles long-lived TV sessions
Why it matters
Session management balances a frictionless 'stay signed in' experience with security and business rules. It underpins concurrency limits (how many streams at once), device management (which devices are logged in), and the ability to revoke access on password change or account sharing — all while keeping tokens secure across long-lived TV logins.
Key points
- Issues, refreshes, tracks, and revokes sessions
- Enables concurrency and device limits
- Supports sign-out everywhere and revocation
- Balances convenience with security
How it works
1
Issue
Grant tokens at sign-in.
2
Maintain
Refresh so users stay logged in.
3
Track
Record active sessions per device.
4
Revoke
Sign out or invalidate on change.
Where you encounter it
Multi-device login continuityConcurrency and device limitsSign-out everywhere / revocationLong-lived TV logins
Key variations
Token-based
Access + refresh tokens.
Per-device sessions
Tracked and revocable.
Global sign-out
Revoke all sessions at once.
Real-world example
Curbing account sharing
A service saw widespread credential sharing.
Challenge
- No visibility into active sessions
- Couldn't enforce device or concurrency limits
Action taken
- Added per-device session tracking and limits
- Enabled remote revocation and global sign-out
Outcome
Excess sharing dropped while legitimate multi-device use stayed smooth.
Frequently asked questions
What is session management in streaming?
Session management controls a user's active login sessions across devices — issuing, refreshing, tracking, and revoking them — to keep viewers signed in securely and enforce limits.
How does session management enforce concurrency limits?
By tracking active sessions per device, it can count simultaneous streams and block or revoke sessions that exceed a plan's concurrency limit.
Can users be signed out of all devices?
Yes — session management supports global sign-out and revocation, invalidating tokens across devices on password change, sharing detection, or user request.
What should end a streaming session?
Explicit sign-out, token expiry without refresh, exceeding concurrency limits, device removal, subscription lapse, or a security event such as a password change. Each should propagate quickly to active playback, not just to the next app launch.
How do I handle sessions across many devices?
Track sessions server-side with a device identifier, platform and last-seen timestamp, so you can enforce concurrency, show viewers their active devices and revoke individually. Client-only session state can't support any of that reliably.
Build it with Enveu
Manage sessions securely
Enveu handles secure multi-device sessions, concurrency, and revocation out of the box.