Session token invalidation ambiguity for concurrent Salesforce API sessions

Session Invalidation Scope

A timed-out session invalidates only that specific session. If a user has multiple concurrent sessions—such as one active browser window (UI) and several independent API integrations—the expiration of one session ID does not trigger a cascade that revokes other active sessions for that user.

Likely Explanations vs. Confirmed Behavior

While the SESSION_EXPIRED error is generic, the underlying behavior differs based on the authentication method and the trigger of the invalidation:

Timeout-Based Expiration

• Behavior: Localized. When the session timeout limit (defined in Session Settings) is reached, only the session ID associated with that specific inactivity window is revoked.
• UI vs. API: A UI session timeout will not invalidate a concurrent API session, and vice versa.

Global Revocation Events

Certain actions do trigger a global invalidation across all contexts (UI, API, and OAuth):

• Password/Security Token Changes: Updating these credentials typically forces a reset of all active sessions.
• Administrative Action: Administrators can use the "Logout All Active Sessions" button on the User record to immediately revoke every active session for that specific user.

JWT Bearer Token Context

JWT Bearer tokens operate differently than standard session IDs. Because they are short-lived and generated via a digital signature, their expiration is tied to the token's own exp claim. A SESSION_EXPIRED error in a UI session has no impact on the validity of a JWT-based API flow, as they rely on different authentication mechanisms.

Verification Steps

To confirm this behavior in your specific environment, perform the following test:

1. Establish two concurrent sessions: one via the Salesforce UI and one via an API tool using a different authentication method (e.g., JWT or a separate Login call).
2. Allow the UI session to time out naturally or manually clear the browser cookies.
3. Execute an API request using the second session ID. The request should succeed, confirming that invalidation is not global.
4. Have an administrator trigger "Logout All Active Sessions" for your user and verify that both the UI and API requests now return SESSION_EXPIRED or an invalid grant error.

Diagnostic Detail Needed: Are you utilizing a custom Session Setting (e.g., "Lock sessions to the IP address from which they originated")? This setting can cause unexpected SESSION_EXPIRED errors if the client IP rotates, which may mimic a global invalidation event.