---
title: "Logging out / Revoking an App User"
method: DELETE
path: "/v1/sessions/{token}"
tags: ["Session Authentication"]
---

# Logging out / Revoking an App User

`DELETE /v1/sessions/{token}`

Logging out is not strictly necessary for Web Users; all sessions expire 24 hours after they are created. But it can be a good idea, in case someone else manages to steal your token. It is also the way Public Link and App User access are revoked. To do so, issue a `DELETE` request to that token resource.

**Revoking an App User**

The token associated with an App User is actually just its Session Token. As a result, although an App User Token can uniquely be used as a URL prefix as described here, the session associated with it can be revoked in exactly the same way a session is logged out, by issuing a `DELETE` request to its Session resource.

Note, however, that an App User cannot revoke itself; a `User` must perform this action.

## Path parameters

- `token` string, required

## Response `200`

OK

- Success
  - `success` boolean, required

## Changes

- **2025-12-20** `022694254f0d` — 1 info
  - api operation id `Revoking an App User` removed and replaced with `revokeAppUser`
- **2025-10-27** `b11b54eea487` — 1 info
  - removed the non-success response with the status `403`
- **2025-03-13** `e8c2858fd4eb` — 2 info
  - api operation id `revokeAppUser` removed and replaced with `Revoking an App User`
  - added the non-success response with the status `403`

[Change history](https://skmtc.dev/getodk/apis/odk-central-api/changes/v1/sessions/:token/delete.md)

---

[API](https://skmtc.dev/getodk/apis/odk-central-api.md) · [All operations](https://skmtc.dev/getodk/apis/odk-central-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/getodk/odk-central-api/revisions/d4f5ba77f644/schema)