Manage Logged in Devices
Manage Logged-in Devices
You can view all devices currently signed in to your Expensify account and revoke access for devices you no longer trust. This is useful if you lose a device, notice suspicious account activity, or want to remove old login sessions.
Who can manage devices
All Expensify members can view and revoke device access on web or mobile for their own account sessions.
How to view and revoke logged-in devices in Device management
- In the navigation tabs (on the left on web, on the bottom on mobile), click Account.
- Click Security.
- Click Device management.
- Review the list of devices that have access to your account. Each entry shows the device name, operating system, and when it was last active.
- To remove a device, click Revoke next to it.
Each listed device represents an active login session on your account. Devices may appear multiple times if you signed in using different browsers, apps, or devices.
What OAuth and MCP connections appear in Device management
Some entries in your device list are app connections you authorized through OAuth rather than a phone, tablet, or browser. These include AI assistants and other tools connected through the Model Context Protocol (MCP), such as Claude, Cursor, or ChatGPT.
These connections appear with a label like OAuth - MCP (Claude) instead of a device name and operating system. If the connected tool isn’t recognized, the entry shows OAuth - MCP.
To disconnect one of these tools from your account, click Revoke next to it. The tool immediately loses access and must be reauthorized before it can connect again.
What happens after you revoke device access
The selected device is immediately signed out of your Expensify account. Anyone using that device must sign in again to restore access.
Revoking a device does not:
- Reset your password
- Sign out other active devices
- Enable two-factor authentication
- Remove access from devices that were not revoked
FAQ
Can I revoke access to a lost or stolen device?
Yes. Open Device management, find the device you want to remove, and click Revoke to sign that device out remotely.
Why do I see multiple devices listed?
Each browser, mobile app, or device creates a separate login session. You may see multiple entries if you signed in from different locations or browsers.
Can I revoke all devices at once?
No, devices must be revoked individually.
What information can I see for each device?
The device list shows the device name, operating system or browser, and the last time the device accessed your account. Authorized app connections appear with a label like OAuth - MCP (Claude) instead of a device name and operating system.
What does “OAuth - MCP (Claude)” mean in my device list?
It’s an app you authorized to access your Expensify account through OAuth, such as an AI assistant connected through the Model Context Protocol (MCP). The label shows which tool is connected, for example OAuth - MCP (Cursor) or OAuth - MCP (ChatGPT). Click Revoke to disconnect it.
