v1

latestOpenAPI 3.0.32026-07-26172157253.6 KB

Client

Logout user

Logout the current client session.

Web clients use the httpOnly refresh token cookie. If a valid web refresh cookie is present, the request must include the X-CSRF-Token header returned from login, registration, or refresh. Missing, expired, invalid, or wrong-session-type refresh cookies are cleared idempotently and still return success. Mobile, desktop, and server clients do not have server-side logout state and should discard their stored refresh token after this request.

post/api/auth/logout

Query parameters

client_type'web' | 'mobile' | 'desktop' | 'server'

Client type. Web clients clear the httpOnly refresh cookie; other clients should discard their local refresh token.

Headers

X-CSRF-Tokenstring

CSRF token required for web clients when a valid refresh cookie is present

Response

Logged out successfully. Also returned when the refresh cookie is missing, expired, invalid, or the wrong session type.

successboolean

messagestring