POST
/api/auth/logout/{client_app_id}PublicLog out of a client application
Ends the browser's session with client_app_id: when the app's refresh token cookie is present and verifies, that refresh token and the access tokens minted with it are revoked server-side (other devices and other apps stay signed in), then the app's refresh token cookies are cleared. Browser callers (an Origin header is present) must come from an origin registered for the app and receive credentialed CORS headers; web apps must always send an Origin. Answer OPTIONS for the CORS preflight.
operationId
post_api_auth_logout_client_app_idAuthenticationAuthentication & permissionsPublic
Anyone — no credentials required
- Accepted credentials
- None required
- Notes
- Needs no credentials: an expired or missing refresh token still clears the cookies.
Path parameters
| Name | Type | Description |
|---|---|---|
| client_app_id* | string | Client application to log out of |
Responses
application/json
LogoutResponse
| Property | Type | Description |
|---|---|---|
| success* | true | |
| error* | false | |
| message* | string |
JSONExample
"success"true
"error"false
"message""string"
Example request
bashcurl
curl -X POST 'https://auth.schemavaults.com/api/auth/logout/<client_app_id>'