@crystar Another choice would be to utilize custom integration code in order to set a cap on the number of sessions (refresh tokens) that a single user is permitted to have scoped to them.