---
title: Logs
description: Every sign-in, sign-up and session change, searchable, with how long each is kept.
---

**Logs** lists what happened in an environment, newest first: who signed up,
signed in or out, which sessions were revoked, and every failure worth
knowing about.

## What is recorded

| Event | Recorded when |
| --- | --- |
| Signed up | A new user is created. |
| Signed in | A user signs in, including with ZevID. |
| Signed out | A user signs out. |
| Token refreshed | A session is renewed. |
| Session revoked | A session is ended from the console or the API. |
| Provider access revoked | A user removed your app's access at their sign-in provider. |
| Password changed | A user changes or resets their password. |
| Bot check failed | A request failed human verification. |
| Account locked | Repeated failed sign-ins locked an account. |

Each entry shows when it happened, the user, the outcome and, where known, the
IP address and device. Failures carry the reason.

## Finding things

- **Search** by email or user.
- **Event** narrows to one kind.
- **Outcome** shows only failures or only successes.
- **Time** narrows to the last hour, day, 7 days or 30 days.

Opening **View logs** from a user's page arrives with that user already
filtered. The filter is shown above the list and clears in one click.

## How long logs are kept

Production logs, and webhook delivery history, are kept according to your
plan:

| Plan | Kept for |
| --- | --- |
| Free | 7 days |
| Pro | 30 days |
| Business | 90 days |
| Enterprise | Agreed in your contract |

Development environments keep auth logs for 7 days and webhook deliveries for
3, whatever the plan.

> **Note:**
> Logs are for looking back. To act on an event as it happens, have it sent to
> your server with a [webhook](/api/webhooks).