# `createClient().auth.session`

```ts
createClient().auth.session.list() -> /list-sessions
createClient().auth.session.revoke() -> /revoke-session
createClient().auth.session.revoke() -> /revoke-sessions
createClient().auth.session.revokeOther() -> /revoke-other-sessions
```

`revoke()` maps to singular vs plural route based on payload cardinality in the SDK layer.

Session-protected routes currently resolve the session token from:

1. `Authorization: Bearer <session-token>`
2. the configured session cookie

If both are present, bearer wins. The default cookie name is `athena-auth.session-token`.

See [Auth runtime behavior](../runtime-behavior.md#admin-api-authentication-model) for the shared session-resolution rules used by admin and other protected routes.
For shared parent-domain cookies across `auth.*` and `app.*` sibling subdomains, see [Shared session cookies for direct auth](../shared-session-cookies.md).
