Sign in
Embedded Wallet Auth

Revoke an authentication session

Revoke an authentication session on an Embedded Wallet internal account. Revocation is a two-step signed-retry flow:

  1. Call DELETE /auth/sessions/{id} with no headers. The response is 202 with a payloadToSign, requestId, and expiresAt.

  2. Use the session API keypair of a verified session on the same internal account (this can be the session being revoked, for self-logout) to build an API-key stamp over payloadToSign, then retry the same DELETE request with that full stamp as the Grid-Wallet-Signature header and the requestId echoed back as the Request-Id header. The signed retry returns 204.

Sessions also expire on their own. 404 is returned whenever the id does not match an active session — whether the session was never issued, was already revoked by a prior call, or has expired past its expiresAt. The response code reflects the resource state, not an error in the client's flow: re-revoking an already-revoked or expired session is safe and idempotent at the user intent level.

delete/auth/sessions/{id}

Path parameters

idstring required

The id of the session to revoke.

Headers

Grid-Wallet-Signaturestring

Full API-key stamp built over the prior payloadToSign with the session API keypair of a verified session on the same internal account. Required on the signed retry; ignored on the initial call.

Request-Idstring

The requestId returned in a prior 202 response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with Grid-Wallet-Signature.

Response

The revocation's underlying wallet-provider activity is still in flight — a WalletOperationProcessing body with status: "PROCESSING". The client re-sends the same signed DELETE until it settles; the backend also reconciles the revocation to terminal on its own.

status'PROCESSING' required

Always PROCESSING. Marks a still-in-flight operation whose terminal result is not yet available.

messagestring

Human-readable explanation that the operation is still being processed and the same request may be retried.

Example response

{
  "status": "PROCESSING",
  "message": "This login is still being processed. Retry the same request in a moment."
}

Changes