When using the Acumatica REST API, the logout request may appear to complete but the user session remains active. Over time, this can result in the following error during login:
"The number of concurrent API logins specified for your user account on the Users (SM201010) form has been reached."
This occurs because previous API sessions have not been successfully terminated.
Cause
The logout request must include the authentication cookies created during a successful login.
If the ASP.NET_SessionId and .ASPXAUTH cookies are missing or incorrect, the server cannot identify the active session to terminate it, leaving the session active.
Resolution
Ensure that your API logout request includes both of the following authentication cookies:
-
ASP.NET_SessionId -
.ASPXAUTH
These cookies are generated after a successful sign-in and should be passed in the request headers (or cookie header) when calling the logout endpoint.
You can retrieve these values from the Cookies or Headers section of your API client (for example, Postman) after logging in.
Once these cookies are included, the logout request will correctly terminate the active session, preventing API login sessions from accumulating.