Skip to main content
POST

User Logout

Logout users and invalidate their refresh tokens to ensure secure session termination.

Authentication

This endpoint does not require authentication as it’s used to terminate the user session.

Request Body

string
required
The refresh token to invalidate during logout.

Response Fields

string
required
Human-readable message describing the result of the operation.
string
required
Operation status. Always “success” for successful logout.

Error Responses

Causes:
  • Missing refresh token
  • Invalid request format
Causes:
  • Invalid refresh token
  • Already expired refresh token
  • Token already invalidated
Solution: Wait for the rate limit window to reset before making another logout request.

Usage Examples

Complete Logout Implementation

Rate Limits

  • Rate Limit: 10 requests per minute per user
  • Burst Limit: 20 requests per 5-minute window

Security Considerations

  • Refresh tokens are immediately invalidated on the server
  • Access tokens become invalid when they expire (no immediate invalidation)
  • Implement client-side token cleanup for immediate effect
  • Clear all client-side stored tokens and session data
  • Implement proper session cleanup on the server side
  • Redirect users to login page after logout
  • Always clear client-side tokens even if server logout fails
  • Implement graceful degradation for network failures
  • Log logout events for security monitoring

Best Practices

Server-Side Invalidation

Call the logout endpoint to invalidate refresh tokens on the server.

Client-Side Cleanup

Clear all stored tokens and session data from the client.

Session Termination

Terminate any active sessions and redirect to login page.

Error Handling

Implement proper error handling to ensure cleanup happens even if server request fails.

Integration with Authentication Flow

  1. Login: User authenticates and receives access/refresh tokens
  2. API Usage: Access token used for authenticated requests
  3. Token Refresh: Refresh token used to get new access tokens
  4. Logout: Refresh token invalidated, user session terminated
Pro Tip: Implement a comprehensive logout flow that handles both server-side token invalidation and client-side cleanup to ensure complete session termination.