Logout

End the current session and invalidate the session token

POST /api/auth/logout

Logout

cURL

curl --request POST \
  --url https://api.example.com/api/auth/logout

200

{
  "success": true,
  "data": {
    "message": "<string>"
  }
}

Endpoint

Destroys the current session and invalidates the session token. After logout, the token can no longer be used to authenticate requests.

Authentication

Requires a valid session token via:

• Authorization: Bearer <token> header, or
• heimdall_session cookie

Request

No request body required.

Example

cURL

curl -X POST https://heimdall.example.com/api/auth/logout \
  -H "Authorization: Bearer <your_session_token>"

Response

Success Response

success · boolean

Always true for successful logout

data · object

Show properties

message · string

Success message (always “Logged out”)

{
  "success": true,
  "data": {
    "message": "Logged out"
  }
}

Error Responses

401 Unauthorized - No token provided

{
  "success": false,
  "error": {
    "code": 401,
    "message": "No session token provided"
  }
}

500 Internal Server Error

{
  "success": false,
  "error": {
    "code": 500,
    "message": "Internal server error"
  }
}

Notes

• Logout is idempotent — calling it multiple times with the same token (even after invalidation) returns success
• Invalid or expired tokens also receive a 200 success response
• After logout, the session is permanently deleted from the database
• If using cookies, the client should clear the heimdall_session cookie after receiving the logout response

Related Endpoints

• Login - Authenticate and create a session
• Register - Create a new account
• Get Current User - Get current user details