---
title: "Driver App session contract"
description: "Maintain the reviewed session list, activation, deletion, logout guard, and local cleanup boundaries."
canonical: https://docs.ordering.co/docs/developers/driver-app/session-contract/
---

# Use the reviewed session contract

Driver App session management has two related but distinct workflows:

- **Sessions** lists and deletes current or other account sessions when the account uses the multi-session strategy.
- **logout** checks active orders, requests server logout, then coordinates local session, order and storage cleanup.

Neither workflow is atomic. A visible list, primary API success, local auth change or signed-out screen does not prove complete token, push, availability, log, job, socket, provider or storage cleanup.

## Availability

The Sessions route is registered in authenticated navigation and opened from Profile. Accounts using the multi-session strategy can load dated session rows and current markers. Other strategy state shows an activation control instead of a list.

## Prerequisites

- Authenticated self scope and current session-strategy state.
- Explicit distinction among current, other and all sessions.
- Destructive confirmation for individual and bulk deletion.
- Complete local/server/provider cleanup plan when current session is deleted.
- Active-order guard and order-owner recovery before logout.
- Synthetic session IDs/dates/tokens only in tests and documentation.

## Responsibility boundaries

| Boundary                 | Responsibility                                                                 | Limit                                                     |
| ------------------------ | ------------------------------------------------------------------------------ | --------------------------------------------------------- |
| Sessions UI              | Show loading/list/empty/activation, current marker and confirmations.          | Presentation order is not server sort/currentness.        |
| Sessions controller      | List sessions, optionally sort, delete one/all/others and update local list.   | Primary response and local session effects can diverge.   |
| Current-session deletion | Remove row server-side then request local logout.                              | Local logout is not awaited in reviewed deletion handler. |
| Other-session deletion   | Remove returned row from local list after primary success.                     | Remote device/token/provider cleanup unproven.            |
| Bulk delete              | Delete current+all or preserve current based on explicit input.                | Confirmation closes before async handler settles.         |
| Activation path          | Reuse bulk contract preserving current, then locally switch strategy metadata. | Activation is not proven by button or local metadata.     |
| Logout                   | Client active-order read, API logout, local session/order/storage cleanup.     | Guard failures and cleanup can partially settle.          |
| API                      | Enforce self/admin session access and server-side logout/order guards.         | Running artifact relation remains unconfirmed.            |

## Inputs and result

| Input/action              | Client result                                      | Failure/partial boundary                                                                       |
| ------------------------- | -------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Multi-session strategy    | Authenticated list request, optional date sort.    | App supplies no explicit sort; UI reverses the array in render and mutates presentation order. |
| Legacy/non-list strategy  | Empty local list plus activation message/control.  | Activation request/result and local strategy switch separate.                                  |
| Delete other session      | Confirmation, API delete, remove row locally.      | Remote session/provider cleanup unproven.                                                      |
| Delete current session    | API delete, remove row, request local logout.      | Logout not awaited; navigation/storage can race.                                               |
| Delete all sessions       | Bulk API delete, empty list, request local logout. | Per-session/provider cleanup and local state separate.                                         |
| Delete all except current | Bulk API delete, retain current rows locally.      | Remote-session cleanup not proven; activation can reuse current token metadata.                |
| logout                    | Active-order guard then server/local cleanup.      | Guard exception can continue; broad storage clear is not awaited.                              |

## Security and privacy

- Never expose session IDs, tokens, socket IDs, device data or exact timestamps in public artifacts.
- Require self/admin authorization on every list/delete operation.
- Treat current-session deletion and logout as security-sensitive destructive workflows with complete receipts and rollback/recovery.
- Bind late list/delete/logout responses to current account/session generation.
- Do not infer remote-session closure from a row disappearing locally.

## Limits and failure states

| State                    | Meaning                                        | Maintainer response                                |
| ------------------------ | ---------------------------------------------- | -------------------------------------------------- |
| Loading/error            | Session list/action unsettled.                 | No repeat/destructive action.                      |
| Empty list               | Current response has no displayable sessions.  | Not proof no remote token/session exists.          |
| Current marker           | API row marked current.                        | Verify server/session generation before deletion.  |
| Row removed locally      | Primary delete reported success.               | Remote provider/token cleanup unproven.            |
| Signed-out UI            | Local auth changed.                            | Server/storage/push/socket cleanup unproven.       |
| Sort order changes       | UI reversed/mutated list during render.        | Do not use order as security/currentness evidence. |
| Activation-looking state | Local strategy changed after primary response. | Server feature/current session semantics unproven. |
| Logout guard error       | Active-order check failed.                     | Can ambiguously continue; stop and reconcile.      |

## Troubleshooting

Use synthetic sessions and intercepted API/session/order/storage/socket/provider adapters. Never delete a real session or logout to test. Diagnose list result, sort/presentation, primary delete, local session change, storage cleanup and provider/token cleanup as separate ledgers.

Re-review whenever session strategy, list sort, current marker, individual/bulk delete, activation, active-order guard, logout, local storage or provider cleanup changes.

**Related guides:** [Manage sessions](https://docs.ordering.co/docs/products/driver-app/account/sessions/) · [Sign out](https://docs.ordering.co/docs/products/driver-app/account/sign-out/) · [Delete account](https://docs.ordering.co/docs/products/driver-app/account/delete-account/) · [Authenticated bootstrap](https://docs.ordering.co/docs/developers/driver-app/authenticated-bootstrap/) · [Notifications contract](https://docs.ordering.co/docs/developers/driver-app/notifications-contract/) · [Offline actions](https://docs.ordering.co/docs/developers/driver-app/offline-actions/)