Sessions and networks
Short answer: a portal sign-in is tied to the network you signed in from. If your network changes (Wi-Fi to mobile, VPN on or off), StackTether signs your web sessions out and shows "You were signed out because your network changed. Sign in again." AI app connections are not affected, because AI apps call from their vendor's servers; they have their own protections.
Web (portal) sessions
- Tied to your network: the exact IPv4 address, or the same /64 block for IPv6.
- A different network ends every portal session of yours and is recorded in your history.
- Login cookies cannot be read by page scripts and are sent over HTTPS only.
- A stolen session token is useless away from StackTether's own server, because the database only answers StackTether's server.
Signed out after inactivity
A portal sign-in ends after a period with no activity: 15 minutes for MSP admins and techs, 5 minutes for StackTether platform admins. Activity means opening a page or sending a form in the portal; moving the mouse does not count.
- One minute before the limit, a small panel says "You'll be signed out in 60 s for inactivity". Choose Stay signed in to keep working, or Sign out now. Escape also keeps you signed in.
- Open tabs stay in step: working in one tab keeps the others signed in too.
- After the limit you see "You were signed out after 15 minutes of inactivity" (or 5) on the sign-in page, and the sign-out is recorded in your history as "Signed out: inactive".
- The limit is enforced by StackTether's server, so it applies even with JavaScript turned off. Only the browser that sat idle is signed out; your other browsers stay signed in.
- AI app connections are not affected. They keep their own limits (below).
What ends sessions
| Event | Portal sessions | AI connections |
|---|---|---|
| Network change | End | Stay |
| No portal activity for 15 minutes (5 for platform admins) | End (that browser) | Stay |
| Signing in to the portal with 2FA | New session | Stay |
| Signing out of the portal | End (that browser) | Stay |
| Sign out everywhere (admin) | End | End |
| Password change or reset, 2FA reset | End | End |
| Pause, delete | End | End |
| App turned off (MSP or for you), Disconnect, Disconnect all | Stay | End |
How AI connections are protected
- Access tokens are refused after 15 minutes; apps renew them in the background.
- Approvals last 30 days (cloud apps) or 7 days (local apps). 14 days without use disconnects.
- Claude's calls must come from Anthropic's published network; ChatGPT's are checked against OpenAI's in watch mode.
- Local apps: optional country list, and admins are emailed about new networks or countries.
- Unusual-activity checks, call budgets, kill switches and the audit log.
FAQ
I get signed out often.
Your network address probably changes, for example a VPN that switches exit points or a phone hotspot. Sign in again; it is expected behaviour. Stable office networks rarely trigger it.
I was signed out while reading a long page.
Reading does not count as activity. When the one-minute warning appears, choose Stay signed in. Platform admins have a shorter limit (5 minutes) because their access covers every MSP.
Why are AI apps treated differently?
Their calls come from the AI vendor's servers, whose addresses change constantly and say nothing about you. Signing them out on every portal network change would disconnect them all the time without adding protection.