Revokes the session for the supplied refresh token. Idempotent — always returns 200, even for an invalid or expired token, so token validity is never disclosed.

POST/api/auth/logout

Request body

requiredapplication/json

refreshTokenstringrequired

The encrypted refresh token issued at login / last refresh.

Responses

200OK

any

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Bodyapplication/json

refreshTokenstring*The encrypted refresh token issued at login / last refresh.

Request

curl -X POST "http://localhost:8000/api/auth/logout" \
  -H "Content-Type: application/json" \
  -d '{
  "refreshToken": "iv:authTag:ciphertext"
}'

const response = await fetch("http://localhost:8000/api/auth/logout", {
  method: "POST",
  headers: {
    "Content-Type": "application/json"
  },
  body: "{\n  \"refreshToken\": \"iv:authTag:ciphertext\"\n}"
});

Response

{
  "message": "You have been logged out"
}