---
title: "Revoke All Sessions"
method: POST
path: "/auth/revoke-sessions"
tags: ["auth"]
---

# Revoke All Sessions

`POST /auth/revoke-sessions`

## Request

- Base URL: `https://api.openproof.io` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openproof.io/auth/revoke-sessions`
- Auth: HTTP bearer

Security hardening item 1 (23 Sep 2026) -- 'log out all devices'.
Bumps token_version so every access token issued before this
moment (across every browser/device) now fails the `tv` check in
get_current_user, regardless of its remaining expiry. Coarse
(all-or-nothing), not per-device selective revocation -- that would
need a real per-token session table, a bigger build than what this
backlog item asked for.

Includes the CALLING device's own current token -- the frontend
must clear local storage and redirect to login right after this
call returns, not expect to remain signed in, since this request's
own token becomes invalid the instant the commit below lands.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/openproof/apis/openproof-api.md) · [All operations](https://skmtc.dev/openproof/apis/openproof-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openproof/apis/openproof-api/revisions/ddd0cac7c37e?raw)