Redis-backed distributed sessions with full lifecycle control.
Token lifecycle, location tracking, concurrent session limits, instant revocation. Your app never manages session state — the MVP handles it end to end.
On successful authentication, the MVP creates a session record in Redis with the user's ID, roles, email, IP address, user agent, and an expiration timestamp.
Every request passes through middleware that validates the session token against Redis. If the session exists and hasn't expired, the request proceeds with the user context attached.
The admin dashboard shows all active sessions — user, device, IP, location, last activity. Admins can revoke any session instantly, and the next request from that session gets a 401.
Sessions are distributed across Redis, so they work identically across multiple app instances. Horizontal scaling doesn't break sessions.
Sessions need sub-millisecond reads on every single request. Hitting PostgreSQL for session validation would add latency to every page load and API call. Redis gives you: O(1) lookups, automatic TTL-based expiration, pub/sub for real-time revocation events, and zero garbage collection. Sessions that expire simply vanish from memory.
Every session records the device, browser, IP address, and geolocation (via IP). The admin panel shows a real-time view of all active sessions for any user. This isn't just a security feature — it's a compliance requirement for many industries. Auditors want to know: who was logged in, from where, at what time. The session table answers that without any custom code.
// Session record in Redis
{
"userId": 42,
"email": "jane@acme.com",
"roles": ["vibe_app_admin"],
"ip": "203.0.113.42",
"userAgent": "Chrome/120 macOS",
"location": "San Francisco, CA",
"createdAt": "2026-03-11T14:30:00Z",
"expiresAt": "2026-03-12T14:30:00Z",
"lastActivity": "2026-03-11T16:45:00Z"
}When an admin revokes a session from the dashboard, it's deleted from Redis immediately. The very next request from that session token gets a 401 and the user is redirected to login. This also applies to: password changes (all other sessions revoked), role changes (session refreshed with new roles), and account deactivation (all sessions destroyed).
Because sessions are in Redis (not localStorage or cookies alone), the system knows about all of a user's sessions across devices. The mobile app (via payez-react-native-mvp) shares the same session store. This means the admin panel shows both web and mobile sessions in one view. A user who logs in on their phone and their laptop has two session records, both visible, both revocable.
Configurable per-tenant: maximum concurrent sessions, session TTL, idle timeout, and forced re-authentication intervals. These are enforced at the middleware level — your app code doesn't need to check. Examples: - "Max 3 concurrent sessions per user" — the 4th login revokes the oldest session - "Idle timeout: 30 minutes" — inactive sessions auto-expire - "Re-auth every 24 hours" — even active sessions require a fresh login daily
Session Management ships with every @payez/next-mvp install. 10K MAU free. No credit card required.