Sign out

Signing out ends the browser session on fermium.app. It does not touch the agents and scripts that publish on your behalf.

How

Click Sign out in the site header or in the app's account menu. The browser posts to /auth/logout; the server clears the session cookie and sends you to the sign-in page.

Because the session is a signed cookie rather than a server-side record, signing out on one browser does not sign you out on another. Each browser holds its own cookie; sign out on each device you used.

What keeps working after sign-out

• Agents. Claude Code, Cursor and other MCP clients hold their own OAuth tokens. They keep working until the token expires or you revoke it. To cut an agent off, go to Settings, then API keys and tokens and revoke its token; the grant is revoked with it, so the client cannot refresh.
• Static tokens. dsk_ tokens you minted for scripts are unaffected by sign-out. Revoke them on the same page.
• Viewer access on the content host. If you opened Restricted documents, the content host holds a separate viewer cookie for up to 12 hours. Signing out of the app does not clear it; it expires on its own, or you can clear cookies for fermiumusercontent.app and any custom domain.
• Password documents. Browsers cache HTTP Basic credentials for the session. Close the browser to forget them.

Lost or shared device

If you signed in on a device you no longer control:

1. Sign in from a device you do control.
2. Open Settings, then API keys and tokens and revoke every token you do not recognize. OAuth grants show up here with the client name.
3. Email hello@fermium.app if you want the browser session on the lost device invalidated before its 90-day expiry. Sessions are signed with the server secret and cannot be revoked individually today, so this is handled on request.

On Business and above, the workspace audit log records every sign-in (user.sign_in, with the method and IP) and every token minted or revoked, so you can see whether the device was used.