POST
/api/auth/logout/{client_app_id}PublicLog out of a client application
Ends the browser's session with client_app_id: when the app's refresh token cookie (or, for SDK clients that hold the refresh token themselves, Authorization: Bearer <refresh token> issued to client_app_id) is present and verifies, that refresh token and the access tokens minted with it are revoked server-side (other devices and other apps stay signed in), then the app's refresh token cookies are cleared. Browser callers (an Origin header is present) must come from an origin registered for the app and receive credentialed CORS headers; web apps must always send an Origin. Answer OPTIONS for the CORS preflight.
operationId
post_api_auth_logout_client_app_idAuthenticationAuthentication & permissionsPublic
Anyone — no credentials required
- Accepted credentials
- None required
- Notes
- Needs no credentials: an expired or missing refresh token still clears the cookies. A Bearer refresh token issued to another app is ignored.
Path parameters
| Name | Type | Description |
|---|---|---|
| client_app_id* | string | Client application to log out of |
Responses
application/json
LogoutResponse
| Property | Type | Description |
|---|---|---|
| success* | true | |
| error* | false | |
| message* | string |
JSONExample
"success"true
"error"false
"message""string"
Example request
bashcurl
curl -X POST 'https://auth.schemavaults.com/api/auth/logout/<client_app_id>'