> ## Documentation Index
> Fetch the complete documentation index at: https://codebyahmed.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Log Out and Revoke the Current Session via Auth API

> Revoke the current session and clear the session cookie. Requires an active session; returns 204 even if the session was already revoked.

The session endpoints let you inspect your current authenticated session and log out by revoking it. When you log out, the server invalidates the session record and instructs the browser to clear the `session` cookie — any further requests using that cookie will receive a `401` response.

## Inspect the Current Session

Before logging out you can call `GET /auth/session` to confirm the session is active and retrieve basic profile information.

### Endpoint

```http theme={null}
GET https://api.example.com/api/v1/auth/session
```

Requires an active session cookie. No CSRF token is needed for read-only requests.

### Example Request

<CodeGroup>
  ```bash cURL theme={null}
  curl -X GET https://api.example.com/api/v1/auth/session \
    -b cookies.txt
  ```

  ```js JavaScript (fetch) theme={null}
  const response = await fetch(
    "https://api.example.com/api/v1/auth/session",
    { credentials: "include" }
  );
  const data = await response.json();
  ```

  ```python Python (requests) theme={null}
  resp = session.get("https://api.example.com/api/v1/auth/session")
  print(resp.json())
  ```
</CodeGroup>

### Success Response — `200 OK`

```json theme={null}
{
  "success": true,
  "data": {
    "public_id": "usr_01H",
    "email": "jane@example.com",
    "role": "CUSTOMER",
    "email_verified": true
  }
}
```

<ResponseField name="data" type="object">
  <Expandable title="data fields">
    <ResponseField name="public_id" type="string">
      Your account's public identifier, prefixed `usr_`.
    </ResponseField>

    <ResponseField name="email" type="string">
      The email address on your account.
    </ResponseField>

    <ResponseField name="role" type="string">
      One of `CUSTOMER`, `ADMIN`, or `SUPER_ADMIN`.
    </ResponseField>

    <ResponseField name="email_verified" type="boolean">
      Whether your email address has been verified.
    </ResponseField>
  </Expandable>
</ResponseField>

***

## Log Out — Revoke Current Session

### Endpoint

```http theme={null}
DELETE https://api.example.com/api/v1/auth/session
```

Requires an active session cookie. Because this is a state-changing `DELETE` request, you must first obtain a CSRF token via `GET /auth/csrf-token` and pass it in the `x-csrf-token` header.

<Info>
  The server returns `204 No Content` even if the session was already revoked or expired. This idempotent behaviour means it is safe to call the endpoint more than once without worrying about error handling for already-logged-out sessions.
</Info>

### Example Request

<CodeGroup>
  ```bash cURL theme={null}
  # Step 1 — get CSRF token
  CSRF=$(curl -s -b cookies.txt \
    https://api.example.com/api/v1/auth/csrf-token \
    | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['csrf_token'])")

  # Step 2 — log out
  curl -i -X DELETE https://api.example.com/api/v1/auth/session \
    -b cookies.txt \
    -H "x-csrf-token: $CSRF"
  ```

  ```js JavaScript (fetch) theme={null}
  // Step 1 — get CSRF token
  const csrfRes = await fetch(
    "https://api.example.com/api/v1/auth/csrf-token",
    { credentials: "include" }
  );
  const { data: { csrf_token } } = await csrfRes.json();

  // Step 2 — log out
  await fetch("https://api.example.com/api/v1/auth/session", {
    method: "DELETE",
    credentials: "include",
    headers: { "x-csrf-token": csrf_token },
  });
  ```

  ```python Python (requests) theme={null}
  # Step 1 — get CSRF token
  csrf_res = session.get("https://api.example.com/api/v1/auth/csrf-token")
  csrf_token = csrf_res.json()["data"]["csrf_token"]

  # Step 2 — log out
  resp = session.delete(
      "https://api.example.com/api/v1/auth/session",
      headers={"x-csrf-token": csrf_token},
  )
  # 204 No Content — no response body
  ```
</CodeGroup>

### Success Response — `204 No Content`

The session is revoked and the `session` cookie is cleared. The response body is empty.

## Error Responses

| Status             | Meaning           | When it occurs                                                                      |
| ------------------ | ----------------- | ----------------------------------------------------------------------------------- |
| `401 Unauthorized` | Not authenticated | No session cookie was sent, or the cookie references a session that does not exist. |

### Example `401` Response

```json theme={null}
{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "authentication required"
  }
}
```

## Related Endpoints

<CardGroup cols={2}>
  <Card title="List All Sessions" icon="list" href="/api-reference/auth/sessions">
    View every active session across your devices and revoke any of them.
  </Card>

  <Card title="Log In" icon="arrow-right-to-bracket" href="/api-reference/auth/login">
    Start a new session after logging out.
  </Card>
</CardGroup>