sign-in

Sign out: revoke the key making this call

Revokes the calling key and nothing else. A web sign-in key is always revoked; any other key keeps the rule that an account's last active key cannot be revoked (409 last_active_key). Any key may call it, whatever its scopes. Free. Called from the web's own origin, it also clears the session cookie, whatever it answers (FAILURE_MODES.md WS8), so a browser can always sign out.

post/v1/auth/signout

Request

  • Base URL: https://api.hookdetector.com (the document declares no server; this is the origin it was published from)
  • URL: https://api.hookdetector.com/v1/auth/signout
  • Auth: none declared

Headers

authorizationstring nullable

Bearer hd_... from POST /v1/accounts or POST /v1/keys

Response

Successful Response

signed_outboolean required
key_idstring nullable required
revoked_atstring nullable required
messagestring required

Example response

{
  "key_id": "8f1c2d3e-4b5a-4c6d-8e7f-9a0b1c2d3e4f",
  "message": "Signed out. This key no longer works.",
  "revoked_at": "2026-09-23T10:00:00.000000+00:00",
  "signed_out": true
}

Changes

No recorded changes to this operation across all 1 revision of this API.