Log Out and Revoke the Current Session via Auth API

The session endpoints let you inspect your current authenticated session and log out by revoking it. When you log out, the server invalidates the session record and instructs the browser to clear the session cookie — any further requests using that cookie will receive a 401 response.

Inspect the Current Session

Before logging out you can call GET /auth/session to confirm the session is active and retrieve basic profile information.

Endpoint

GET https://api.example.com/api/v1/auth/session

Requires an active session cookie. No CSRF token is needed for read-only requests.

Example Request

curl -X GET https://api.example.com/api/v1/auth/session \
  -b cookies.txt

const response = await fetch(
  "https://api.example.com/api/v1/auth/session",
  { credentials: "include" }
);
const data = await response.json();

resp = session.get("https://api.example.com/api/v1/auth/session")
print(resp.json())

Success Response — `200 OK`

{
  "success": true,
  "data": {
    "public_id": "usr_01H",
    "email": "jane@example.com",
    "role": "CUSTOMER",
    "email_verified": true
  }
}

object

Show data fields

string

Your account’s public identifier, prefixed usr_.

string

The email address on your account.

string

One of CUSTOMER, ADMIN, or SUPER_ADMIN.

boolean

Whether your email address has been verified.

Log Out — Revoke Current Session

Endpoint

DELETE https://api.example.com/api/v1/auth/session

Requires an active session cookie. Because this is a state-changing DELETE request, you must first obtain a CSRF token via GET /auth/csrf-token and pass it in the x-csrf-token header.

The server returns 204 No Content even if the session was already revoked or expired. This idempotent behaviour means it is safe to call the endpoint more than once without worrying about error handling for already-logged-out sessions.

Example Request

# Step 1 — get CSRF token
CSRF=$(curl -s -b cookies.txt \
  https://api.example.com/api/v1/auth/csrf-token \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['csrf_token'])")

# Step 2 — log out
curl -i -X DELETE https://api.example.com/api/v1/auth/session \
  -b cookies.txt \
  -H "x-csrf-token: $CSRF"

// Step 1 — get CSRF token
const csrfRes = await fetch(
  "https://api.example.com/api/v1/auth/csrf-token",
  { credentials: "include" }
);
const { data: { csrf_token } } = await csrfRes.json();

// Step 2 — log out
await fetch("https://api.example.com/api/v1/auth/session", {
  method: "DELETE",
  credentials: "include",
  headers: { "x-csrf-token": csrf_token },
});

# Step 1 — get CSRF token
csrf_res = session.get("https://api.example.com/api/v1/auth/csrf-token")
csrf_token = csrf_res.json()["data"]["csrf_token"]

# Step 2 — log out
resp = session.delete(
    "https://api.example.com/api/v1/auth/session",
    headers={"x-csrf-token": csrf_token},
)
# 204 No Content — no response body

Success Response — `204 No Content`

The session is revoked and the session cookie is cleared. The response body is empty.

Error Responses

Status	Meaning	When it occurs
`401 Unauthorized`	Not authenticated	No session cookie was sent, or the cookie references a session that does not exist.

Example `401` Response

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "authentication required"
  }
}

List All Sessions

View every active session across your devices and revoke any of them.

Log In

Start a new session after logging out.

Auth & Sessions

Account

Catalog

Cart & Checkout

Reviews

Log Out and Revoke the Current Session via Auth API

Inspect the Current Session

Endpoint

Example Request

Success Response — `200 OK`

Log Out — Revoke Current Session

Endpoint

Example Request

Success Response — `204 No Content`

Error Responses

Example `401` Response

List All Sessions

Log In

​Inspect the Current Session

​Endpoint

​Example Request

​Success Response — 200 OK

​Log Out — Revoke Current Session

​Endpoint

​Example Request

​Success Response — 204 No Content

​Error Responses

​Example 401 Response

​Related Endpoints

List All Sessions

Log In

Inspect the Current Session

Endpoint

Example Request

Success Response — `200 OK`

Log Out — Revoke Current Session

Endpoint

Example Request

Success Response — `204 No Content`

Error Responses

Example `401` Response

Related Endpoints