Device Authentication
Limit users to a specific number of devices using hardware IDs to prevent account sharing.
Device authentication is enabled by default and restricts each user to a specific number of devices. When enabled, users must provide a hardware ID (like a MAC address or CPU ID) when logging in.
Device Registration
Devices are automatically registered when a user:
- Signs up
- Logs in from a new device
If the user has already registered the maximum number of devices, the login from a new device will fail with an error.
If you want to free up a device slot for a user, you can unregister their device in the Authgate dashboard.
Session & Device Limit
Users can register up to their allowed number of devices and have a limited number of active sessions across all devices.
As an admin, you can adjust these limits in the user details page. See Device Restrictions for more information.
Logging in again on a registered device revokes old sessions for that device.
Error Handling
When device authentication is enabled, you may encounter these errors:
| Error | Meaning | Solution |
|---|---|---|
Device authentication is required | No hardware_id provided | Include hardware ID in login |
Maximum number of devices reached | User has registered too many devices | Admin must unregister a device first |
Maximum number of simultaneous sessions reached | Too many active sessions | User must log out from another device |
Important Notes
- Consistent IDs: Make sure your hardware ID generation is consistent across app restarts
- Works with All Auth Methods: Device authentication works with Token Auth and Legacy Auth
- Not Anonymous: Device authentication doesn’t apply to anonymous users