Each time you authenticate with leaf login, LeafCloud creates a dedicated session for your machine. You can view and revoke sessions at any time.

List active sessions

To view all active CLI sessions:

leaf sessions

Output:

NAME                     TYPE         ID
leaf on macbook          cli          ses_01ha2k3l4m
leaf on workstation      cli          ses_01ha9n8b7v

With --json, sessions are returned as a list:

leaf sessions --json

{"schema":1,"type":"sessions","data":{"id":"ses_01ha2k3l4m","kind":"cli","name":"leaf on macbook"}}
{"schema":1,"type":"sessions","data":{"id":"ses_01ha9n8b7v","kind":"cli","name":"leaf on workstation"}}

Revoke a session

If a machine is retired or you suspect credentials may have been compromised, revoke its session using its session ID:

leaf sessions revoke ses_01ha2k3l4m

Output:

Revoked session ses_01ha2k3l4m.

With --json:

{
  "schema": 1,
  "id": "ses_01ha2k3l4m",
  "revoked": true
}

Once a session is revoked, any CLI requests from that machine using the revoked session token will immediately fail with authentication error exit code 2.