Skip to main content

Session Inactivity Timeout

Account admins can automatically log members out of the Quave ONE dashboard after a period without trusted user input. The policy is disabled by default and applies to every dashboard member of the account when enabled.

Configure the Timeout​

  1. Open the account's Members page.
  2. Under Access Control, enable Log out inactive members.
  3. Choose the Inactivity timeout.

The available timeouts are 15 minutes, 30 minutes, 1 hour, 4 hours, 8 hours, 1 day, and 7 days. Enabling the policy initially selects 15 minutes. Disable Log out inactive members to stop enforcing the policy for that account.

Only account admins can change this setting. Changes apply immediately.

What Counts as Activity​

Trusted mouse, pointer, keyboard, touch, wheel, and form input in the dashboard resets the inactivity timer. Activity in another Quave ONE tab in the same browser also resets the shared timer.

Background work does not count as member activity. Network traffic, subscriptions, log streaming, page rendering, and route or tab lifecycle events do not reset the timer. If the deadline has already passed, the next input logs the member out instead of starting a new timer.

Logout Scope​

The inactivity policy affects dashboard sessions only:

  • The current browser is logged out, including its other Quave ONE tabs.
  • Other browsers and devices remain signed in.
  • REST API, MCP, CLI, automation, and service credentials are not affected.

If a member can access multiple accounts with inactivity policies, the shortest enabled timeout applies to the shared browser session. Accounts without this setting do not add a timeout, but they cannot override a shorter policy from another accessible account.

When the deadline passes, Quave ONE immediately blocks authenticated dashboard content while it completes logout. If the browser is offline, the expired state remains blocked and logout is retried. The login page then shows Your session expired due to inactivity. Log in again to continue. and preserves a safe return path.

Audit Events​

Quave ONE records both parts of this control in the Audit Log:

  • Session inactivity timeout updated when an admin enables, changes, or disables the setting.
  • Inactivity logout initiated after the current browser session is successfully revoked. When multiple accounts share the shortest enforcing timeout, each of those accounts receives its own audit event.

The audit event includes the member, UI channel, originating IP address, configured timeout, and inactivity deadline. Individual mouse, keyboard, touch, and other raw activity events are not stored in the audit log.