Logging Out Everywhere Is Not Enough: X Session Revocation Explained

When an account shows an unfamiliar sign-in, the reflex is to go into settings and log out of all devices. Then you sign back in and assume it is handled. A few days later a device you do not recognise appears in the list again, because it was never staying in through browser login state.

On X, access lives in three separate credential systems. Logging out everywhere clears one of them.

Three credential types, not one

Browser sessions

This is what "log out of all devices" handles. Each device that signs in holds a session credential with a lifetime set by the platform. Once revoked, that device has to sign in again on its next action.

OAuth grants to third-party apps

Any app you signed into with X, any scheduling tool, any analytics dashboard holds a long-lived grant. That grant does not run through browser login state, so logging out everywhere has no effect on it. What the app holds is permission, not a session.

API tokens and app keys

If you registered a developer app, ran a script or used a third-party deletion tool, you may still have access tokens and keys in place. A leaked token lets an attacker operate your account without ever touching the login page. Legacy tokens are frequently forgotten because nobody revisits them after registration.

Revoke in this order

The order is not arbitrary. Handle the widest scope first, the narrowest last, and change the password only after that, otherwise a new password ends up exposed inside grants that are still active.

Step	What to clear	Where	Effect
1	Third-party app grants you do not recognise or no longer use	Connected apps list in account settings	The app loses read and write access immediately
2	Legacy API tokens and developer apps	App management in the developer dashboard	Every script and tool using that token stops working
3	Browser sessions on all devices	The log-out-everywhere control in security settings	All devices must sign in again
4	Account password	Account settings	Done together with step 3
5	Two-factor method review	Security settings	Confirm recovery methods were not swapped out

Step one is harder than the list makes it sound, because grant entries typically show an app name and nothing about which permissions it holds. Auditing connected app permissions breaks that into a checklist worth running alongside this.

Four things to re-check after revoking

Revoking does not tell you whether someone acted before you got there, so the follow-up pass is not optional.

1. Sign-in history. Look for devices or locations around the revocation that you cannot account for. What matters most is whether anything new appears afterwards.
2. Contact details. Confirm the linked email and phone number are still yours. A common move is to swap in the attacker's recovery email first, which makes a password change useless on its own.
3. Posts and direct messages. Check for content you did not publish, an edited bio, and follow or unfollow activity you cannot explain.
4. Recovery codes. Regenerate the two-factor recovery codes and invalidate the old set. If a screenshot of the old codes sits in a photo library or cloud note, deal with that too.

If you have confirmed someone did get in before you revoked, change the sequence and work through recovering a taken-over account before any cleanup, since regaining control comes first. If you cannot tell takeover from a phishing outcome, comparing against common direct-message phishing patterns helps narrow it down.

When a full revocation is worth it

There is no need to do this routinely, since it interrupts your own signed-in devices. These cases justify a complete pass.

• A sign-in alert arrives, or the history holds an entry you cannot explain.
• A phone is lost, sent for repair or sold, or an old laptop is retired.
• You have moved between several third-party tools and cannot recall which apps you authorised.
• The email tied to the account was caught in a credential-stuffing breach, even if nothing looked wrong at the time.

Once revocation is done, closing the two-factor gap is the highest-value follow-up. Setting up two-factor authentication covers the trade-offs between methods, and any of them beats a password on its own.

One clarification: revoking sessions solves an access problem, which is separate from the risky historic posts sitting inside the account. The first is the lock, the second is what is in the room. If you are working both at once, starting from the login device audit gets the lock confirmed first.

About digital-footprint-health.shop

Once control is confirmed, the remaining question is what the account holds. Upload an X archive at the homepage of digital-footprint-health.shop and the tool parses every post on your own device, returning a tiered list of contact details, location data, institutional ties and opinion posts. Nothing is uploaded to a server and nothing is deleted. Cleanup scope and pricing sit on the pricing page, and the account security write-ups are collected in the blog index.