---
title: "Logout"
method: GET
path: "/auth/logout"
tags: ["auth"]
---

# Logout

`GET /auth/logout`

End the WorkOS session and redirect to frontend login.

OIDC provider spec D-53: dashboard sign-out also revokes EVERY SSO session
record for this user (keyed on user_id — a NULL workos_session_id must not
make records unfindable) and back-channel-terminates the upstream WorkOS
sessions those records held. Revoking our record alone is not sufficient:
/oidc/authorize treats a revoked record as "no session" and bounces to
WorkOS, whose live session would near-silently re-login the previous user.

The get_logout_url redirect hop is deliberately KEPT alongside the
back-channel kill until the Phase-1 human verification confirms
revoke_session alone stops AuthKit silent re-auth (§14); only then may the
hop be dropped. The SSO cookie is cleared on every response as belt over
the record revoke (it was never authoritative, but clearing keeps this
browser signed out even if the DB revoke failed).

## Query parameters

- `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/nanocorp/apis/nanocorp-api.md) · [All operations](https://skmtc.dev/nanocorp/apis/nanocorp-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nanocorp/nanocorp-api/revisions/04b208d3215b/schema)