---
title: "End the browser session (programmatic sign-out)"
method: POST
path: "/auth/v1/sessions/end"
tags: ["Auth"]
---

# End the browser session (programmatic sign-out)

`POST /auth/v1/sessions/end`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/auth/v1/sessions/end`
- Auth: none required

Programmatic sign-out targeted by the @run402/functions auth.sessions.endResponse() helper. Served on the tenant host. NOT behind apikey and NOT CSRF-gated: the session cookie is SameSite=Lax, so a cross-site POST never carries it. Best-effort revokes the session carried in the __Host-Http-r402_session cookie when present, and always returns a clear-cookie Set-Cookie. Idempotent — a missing/invalid cookie still returns ok with no session-existence oracle.

## Response `200`

Signed out; the session cookie is cleared.

- object
  - `ok` boolean

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)