# Log Out

End a session on the server: the refresh token you send is revoked, and it can no longer be exchanged for an access token.

## Overview

- **The refresh token is the credential**, as on [Refresh Token](https://docs.aureahub.com/docs/auth-refresh.md): no tenant signature and no bearer token. Send the refresh token of the session that ends.
- **`200` `{ "success": true }`**, also for a token already revoked: calling it twice is safe.
- **From then on, [Refresh Token](https://docs.aureahub.com/docs/auth-refresh.md) refuses that token**: `401` `Refresh token is no longer valid`. Where refresh-token rotation is on, every refresh token of the same sign-in is revoked with it.
- **Access tokens already issued stay valid until they expire** (15 minutes by default): drop them on the client when you log out.
- Only this session ends: the user's other sign-ins — other devices, other browsers — keep their refresh tokens.
- An administrator's logout is written to your tenant's [audit trail](https://docs.aureahub.com/docs/audit-events.md) as `session.ended` (category `access`), while the trail is on; an End User's is not.
- Rate limit: 60 requests per minute per client IP, as Refresh Token.

## Endpoint

### `POST /v1/auth/logout`

Revokes a refresh token on the server. No tenant signature and no bearer token are needed.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `refreshToken` | string | yes | The refresh token to revoke |

**Responses**

`200` OK

```json
{ "success": true }
```

`401` Unauthorized

```json
{ "error": "UnauthorizedError", "message": "Invalid or expired refresh token" }
```

`429` Too Many Requests

```json
{ "statusCode": 429, "error": "Error", "message": "Rate limit exceeded, retry in 1 minute" }
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/auth/logout \
  -H "Content-Type: application/json" \
  -d '{"refreshToken":"<refresh-token>"}'
```

## Errors

On this endpoint, `401` bodies contain only `error` and `message`. A `401` means there is no session to end with that token: sign the user out on the client anyway.

| Status | message | When |
| --- | --- | --- |
| 401 | `Invalid or expired refresh token` | The token is malformed, badly signed or expired. |
| 401 | `Invalid token type` | The token is not a refresh token (for example, an access token). |
| 400 | `Request validation failed` | The body has no refreshToken. |
| 429 | `Rate limit exceeded, retry in 1 minute` | More than 60 requests in one minute from the same client IP. See the retry-after header. |

---

Web version: https://docs.aureahub.com/#auth-logout