Skip to main content

​
Logout User

curl -X POST https://api.sociapp.com/auth/logout \
  -H "Content-Type: application/json" \
  --cookie "refresh_token=YOUR_REFRESH_TOKEN"

{
  "message": "Logged out successfully"
}

​
Endpoint

POST /auth/logout

​
Authentication

No authentication required. This endpoint can be called by any client to clear cookies.

​
Behavior

When this endpoint is called:
  1. Clears the refresh_token HTTP-only cookie
  2. Sets cookie path to /auth/refresh
  3. Returns success message
The endpoint clears the refresh token cookie with these parameters:
  • Cookie Name: refresh_token
  • Path: /auth/refresh
  • Action: Cookie is removed from client

​
Client-Side Implementation

After calling logout, the client should:
  1. Clear any stored access tokens from memory/localStorage
  2. Clear user state from application store
  3. Redirect to login page
  4. Remove Authorization headers from future requests

​
Example Implementation

// Complete logout flow
async function logout() {
  try {
    // Call logout endpoint
    const response = await fetch('/auth/logout', {
      method: 'POST',
      credentials: 'include'
    });
    
    if (response.ok) {
      // Clear client-side tokens
      localStorage.removeItem('access_token');
      sessionStorage.clear();
      
      // Clear application state
      store.dispatch('auth/logout');
      
      // Redirect to login
      router.push('/');
    }
  } catch (error) {
    console.error('Logout failed:', error);
  }
}

​
Security Notes

  • HTTP-Only Cookies: Refresh tokens are stored in HTTP-only cookies and cannot be accessed by JavaScript
  • Path Restriction: Cookie is scoped to /auth/refresh path only
  • No Server-Side Invalidation: Tokens are not invalidated on the server (stateless JWT design)
  • Token Expiration: Access tokens naturally expire after 15 minutes

​
Token Lifecycle After Logout

Token TypeWhat Happens
Access TokenClient must delete; still valid until expiration (15 min)
Refresh TokenCookie cleared; cannot be used for refresh
Existing access tokens remain valid until their expiration time. For high-security applications, implement server-side token revocation.

​
Frontend Integration (Vue.js Example)

// In your auth store (Pinia)
import { defineStore } from 'pinia';

export const useAuthStore = defineStore('auth', {
  actions: {
    async logout() {
      try {
        // Call logout endpoint
        await fetch('/auth/logout', {
          method: 'POST',
          credentials: 'include'
        });
        
        // Clear local state
        this.user = null;
        this.isAuthenticated = false;
        
        // Redirect
        router.push('/');
      } catch (error) {
        console.error('Logout error:', error);
      }
    }
  }
});

Build docs developers (and LLMs) love

Get started for freeTalk to us