From 277b9cb89c9a9f1fdd7e9245c2844b5b18521929 Mon Sep 17 00:00:00 2001
From: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Date: Mon, 19 Oct 2026 09:34:50 +0200
Subject: [PATCH] Say that two profiles of the same user, tenant and flow share
 one sign-in

Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index a249e67..4b57376 100644
--- a/README.md
+++ b/README.md
@@ -389,6 +389,10 @@ hodeishield login --profile client-b
 
 A profile that has not been defined is refused (`Profile ... is not defined`).
 
+Two profiles signed in as the same user, to the same tenant, with the same flow (browser or
+`--device`) share one sign-in at the app: logging out of either one signs out both. Profiles on
+different tenants, or one signed in with the browser and the other with `--device`, are independent.
+
 `login` first checks that the selected token store is available and stops before opening the browser
 or showing a code if it is not. On a machine without a keychain, see
 [Servers, containers and remote sessions](#servers-containers-and-remote-sessions).