Sign in
Embedded Wallet Auth

Revoke an authentication session

Revoke an authentication session on an Embedded Wallet internal account. Revocation is a two-step signed-retry flow:

  1. Call DELETE /auth/sessions/{id} with no headers. The response is 202 with a payloadToSign, requestId, and expiresAt.

  2. Sign the payloadToSign with the session private key of a verified session on the same internal account (this can be the session being revoked, for self-logout) and retry the same DELETE request with the signature as the Grid-Wallet-Signature header and the requestId echoed back as the Request-Id header. The signed retry returns 204.

delete/auth/sessions/{id}

Path parameters

idstring required

The id of the session to revoke.

Headers

Grid-Wallet-Signaturestring

Signature over the payloadToSign returned in a prior 202 response, produced with the session private key of a verified session on the same internal account and base64-encoded. Required on the signed retry; ignored on the initial call.

Request-Idstring

The requestId returned in a prior 202 response, echoed back on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with Grid-Wallet-Signature.

Response

Challenge issued. The response contains a payloadToSign that must be signed with the session private key of a verified session on the same internal account, along with a requestId that must be echoed back on the retry.

payloadToSignstring required

Payload that must be signed with the session private key of a verified authentication credential. The resulting signature is passed as the Grid-Wallet-Signature header on the retry of the originating request to complete the operation.

requestIdstring required

Unique identifier for this request. Must be echoed in the Request-Id header on the signed retry so the server can correlate the retry with the issued challenge.

expiresAtstring date-time required

Timestamp after which this challenge is no longer valid. The signed retry must be submitted before this time.

type'OAUTH' | 'EMAIL_OTP' | 'PASSKEY' required

The type of authentication credential.

  • OAUTH: OpenID Connect (OIDC) token issued by an identity provider such as Google or Apple.
  • EMAIL_OTP: A one-time password delivered to the user's email address.
  • PASSKEY: A WebAuthn passkey bound to the user's device.

Example response

{
  "payloadToSign": "Y2hhbGxlbmdlLXBheWxvYWQtdG8tc2lnbg==",
  "requestId": "7c4a8d09-ca37-4e3e-9e0d-8c2b3e9a1f21",
  "expiresAt": "2026-04-08T15:35:00Z"
}

Changes