Logout user
Logout the current client session.
Web clients use the httpOnly refresh token cookie. If a valid web refresh cookie is present,
the request must include the X-CSRF-Token header returned from login, registration, or refresh.
Missing, expired, invalid, or wrong-session-type refresh cookies are cleared idempotently and still
return success. Mobile, desktop, and server clients do not have server-side logout state and should
discard their stored refresh token after this request.
Headers
CSRF token required for web clients when a valid refresh cookie is present
Query Parameters
Client type. Web clients clear the httpOnly refresh cookie; other clients should discard their local refresh token.
web, mobile, desktop, server