Logout

Logout user. Tokens are stateless and don't need revocation.

Invariant: the only backend effect of this endpoint is to clear the refresh cookie, idempotently. It never mutates a user, a session record, a token store, or anything else, and behaves identically on the first call and the tenth. Authentication is used only to decide whether the action can be attributed in the audit log — it is deliberately callable with an expired, missing, or absent access token, which is exactly the situation after an offline logout retry or any 15-minute access-token expiry. If a future change gives this endpoint any other effect, it must stop being callable unauthenticated.

Client should discard both access and refresh tokens after logout.