Logout
Authentication
Logout
Client-side logout endpoint
POST
Logout
Client-side logout endpoint. Since Cognito uses stateless JWTs, there is no server-side token invalidation. The client is responsible for discarding stored tokens (access token, refresh token) to complete the logout process.
Authentication
This is a public endpoint that does not require authentication.Rate Limiting
This endpoint is not rate-limited.Request Body
This endpoint does not require a request body.Request Example
Response
Success Response (200 OK)
Confirmation messageAlways returns
"Logged out successfully"Notes
- Server-side token invalidation is not supported. Cognito uses stateless JWTs that cannot be revoked before their expiration time.
- The client application must:
- Delete the access token from local storage/cookies
- Delete the refresh token from local storage/cookies
- Redirect the user to the login page or public landing page
- Existing access tokens will remain valid until they expire (typically 1 hour after issuance)
- For immediate invalidation, consider implementing a token blacklist on the server side, but this is not provided by default
- This endpoint always returns a success response, regardless of whether the user was previously authenticated