---
title: "Logout user"
method: POST
path: "/api/auth/logout"
tags: ["Client"]
---

# Logout user

`POST /api/auth/logout`

Logout the current client session.

Web clients use the httpOnly refresh token cookie. If a valid web refresh cookie is present,
the request must include the `X-CSRF-Token` header returned from login, registration, or refresh.
Missing, expired, invalid, or wrong-session-type refresh cookies are cleared idempotently and still
return success. Mobile, desktop, and server clients do not have server-side logout state and should
discard their stored refresh token after this request.

## Query parameters

- `client_type` 'web' | 'mobile' | 'desktop' | 'server'

## Headers

- `X-CSRF-Token` string

## Response `200`

Logged out successfully. Also returned when the refresh cookie is missing, expired, invalid, or the wrong session type.

- object
  - `success` boolean
  - `message` string

## Other responses

- `403` — Invalid or missing CSRF token for a valid web refresh cookie

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)