---
title: "Sign out: revoke the key making this call"
method: POST
path: "/v1/auth/signout"
tags: ["sign-in"]
---

# Sign out: revoke the key making this call

`POST /v1/auth/signout`

## Request

- Base URL: `https://api.hookdetector.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.hookdetector.com/v1/auth/signout`
- Auth: none declared

Revokes the calling key and nothing else. A web sign-in key is always revoked;
any other key keeps the rule that an account's last active key cannot be revoked (409
last_active_key). Any key may call it, whatever its scopes. Free. Called from the web's
own origin, it also clears the session cookie, whatever it answers (FAILURE_MODES.md
WS8), so a browser can always sign out.

## Headers

- `authorization` string, nullable: Bearer hd_... from POST /v1/accounts or POST /v1/keys

## Response `200`

Successful Response

- SignoutOut
  - `signed_out` boolean, required
  - `key_id` string, nullable, required
  - `revoked_at` string, nullable, required
  - `message` string, required

## Other responses

- `401`: missing, invalid, revoked or expired API key (code key_expired)
- `409`: conflict with the account's state
- `413`: request body over the size cap
- `422`: Validation Error
- `500`: our fault; names the request id

---

[API](https://skmtc.dev/hookdetector/apis/hook-detector.md) · [All operations](https://skmtc.dev/hookdetector/apis/hook-detector/llms.txt) · [OpenAPI document](https://skmtc.dev/hookdetector/apis/hook-detector/revisions/b136a2804d2b?raw)