---
title: "Logout"
method: POST
path: "/api/v1/auth/logout"
tags: ["auth"]
---

# Logout

`POST /api/v1/auth/logout`

## Request

- Base URL: `https://api.badgeia.com`
- URL: `https://api.badgeia.com/api/v1/auth/logout`
- Auth: none declared

Logout the current user.

Three things happen:
  1. Blacklist the access token's JTI so it can't be replayed in the
     remaining window before its natural expiry.
  2. Revoke the exact refresh row bound into the signed access JWT. The
     path-scoped refresh cookie does not need to ride on this request and
     other devices remain active.
  3. Clear both cookies on the response.

Returns 200 with a JSON body. The cookies are cleared via
``Set-Cookie: ...=; Max-Age=0`` on the response (browsers will drop
them; subsequent requests won't carry them).

Token source: the ``badge_session`` cookie first (post-PR-G default),
falling back to ``Authorization: Bearer`` for non-cookie clients. The
pre-PR-F ``as_session`` cookie was dead code and was removed.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/badgeia/apis/badge.md) · [All operations](https://skmtc.dev/badgeia/apis/badge/llms.txt) · [OpenAPI document](https://skmtc.dev/badgeia/apis/badge/revisions/7e7f7fee8b77?raw)