---
title: "Sign Out"
method: POST
path: "/v1/auth/logout"
tags: ["Authentication & API Keys"]
---

# Sign Out

`POST /v1/auth/logout`

## Request

- Base URL: `https://api.vectelos.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.vectelos.com/v1/auth/logout`
- Auth: none declared

Sign out. This ends EVERY session on the account, not only this one.

A JWT cannot be recalled once signed, so "sign out" has to mean invalidating
the tokens rather than forgetting one on the client. Each token carries the
epoch it was minted under; raising the account's epoch refuses all of them
at the next request.

That it signs out everywhere is deliberate, and said plainly here because it
is not what "log out" usually means. The reason to reach for this is a token
you believe someone else has, and in that case ending only the session in
your own browser is precisely the wrong outcome.

API keys are untouched -- they have their own revocation, and an ERP should
not drop because a person signed out of the portal.

## Headers

- `authorization` string, nullable: Bearer <JWT session token>

## Cookies

- `vx_session` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/vectelos/apis/vectelos-api.md) · [All operations](https://skmtc.dev/vectelos/apis/vectelos-api/llms.txt) · [OpenAPI document](https://skmtc.dev/vectelos/apis/vectelos-api/revisions/8e68c96f24fa?raw)