---
title: "Invalidates all access tokens for a user"
method: POST
path: "/_matrix/client/v3/logout/all"
tags: ["Session management"]
---

# Invalidates all access tokens for a user

`POST /_matrix/client/v3/logout/all`

## Request

- Base URL: `https://matrix.org`
- URL: `https://matrix.org/_matrix/client/v3/logout/all`
- Auth: one of:
  - API key in query parameter `access_token`
  - HTTP bearer
- TypeScript: <https://skmtc.dev/matrix/apis/matrix-client-server-api/docs/_matrix/client/v3/logout/all/post.ts> (a function with typed inputs; its response is checked against the schema)

Invalidates all access tokens for a user, so that they can no longer be used for
authorisation. This includes the access token that made this request. All devices
for the user are also deleted. [Device keys](https://spec.matrix.org/v1.19/client-server-api/#device-keys) for the device are
deleted alongside the device.

This endpoint does not use the [User-Interactive Authentication API](https://spec.matrix.org/v1.19/client-server-api/#user-interactive-authentication-api) because
User-Interactive Authentication is designed to protect against attacks where
someone gets hold of a single access token then takes over the account. This
endpoint invalidates all access tokens for the user, including the token used in
the request, and therefore the attacker is unable to take over the account in
this way.

## Response `200`

The user's access tokens were successfully invalidated.

- object

---

[API](https://skmtc.dev/matrix/apis/matrix-client-server-api.md) - [All operations](https://skmtc.dev/matrix/apis/matrix-client-server-api/llms.txt) - [OpenAPI document](https://skmtc.dev/matrix/apis/matrix-client-server-api/revisions/c7fe4072c681?raw)