POST /api/auth/logout

End the current session and invalidate refresh tokens.

This endpoint logs out the currently authenticated user.

It invalidates the active refresh token and clears the session cookie, preventing further token refresh.

When to use

HTTP

POST /api/auth/logout
Authorization: Bearer <access_token>

A valid access token is required to identify the session.

The refresh token cookie must also be present.

Fetch / Axios

credentials: "include"

Response

{
  "success": true
}

The refresh token cookie is cleared and cannot be used again.

Error

{
  "success": false,
  "message": "Unauthorized"
}

Error

{
  "success": false,
  "message": "Too many requests"
}