So from a tokens point of view, you have one session per logged in device. One session contains it's own AT and RT, which are completely independent to another session from the same user. This allows you to check how many sessions belong to a user by checking how many RTs are in the database for that user.