Signing in creates a browser session, and it persists so you are not asked for a password on every visit. Sign out from the account menu when you are finished on a machine that is not yours.
Sessions end for ordinary reasons: signing out, clearing cookies or site data, using a private window that you then close, or a session simply reaching the end of its life. Browsers that aggressively clear storage, and extensions that block cookies for app domains, will sign you out more often than you expect.
Two things a sign-out does not do, and both matter for security:
- It does not revoke API keys. A key that starts with
ag_live_is a separate credential. Anything holding that key, an agent, a script, a CI job, keeps working after you sign out. To stop it, revoke the key under Profile then API keys, where revocation takes effect immediately. - It does not cancel anything. Plans, trials and running background exports continue regardless of whether a browser is signed in.
On a shared or client machine, prefer a private window, and never create an API key there unless you intend to revoke it afterwards. Keys are shown once at creation, so a key copied into someone else's password manager is a key you no longer control.
If you are being signed out constantly, this troubleshooting article covers the usual causes.