Logout

Revoke the current refresh token and invalidate the session. Refresh cookie is cleared.

POST /api/v1/auth/logout — 🌐 Public · Rate limit: 60 req / hour

Revokes the user's refresh token (from biore_refresh httpOnly cookie or body.refreshToken) and clears the cookie. Always returns success even if no token is present (idempotent).

This endpoint marks the Session row revoked. The user's access token (JWT) remains valid until expiry (~15 minutes) — to truly kill access immediately, also invalidate it client-side and rely on the short access TTL.

Request

Cookies

Cookie	Notes
`biore_refresh`	httpOnly cookie, automatically sent. Cleared in response.

Field	Type	Required	Validation	Notes
`refreshToken`	string	—	`@IsOptional() @IsString()`	Used only when no cookie (mobile / non-web client)

Response

`200 OK` — `ApiResponseOf<MessageResponseDto>`

{ "success": true, "data": { "message": "Logged out successfully" } }

The biore_refresh cookie is set with Max-Age=0 (cleared).

Errors

HTTP	`code` / `i18nKey`	Reason
`429`	(throttle)	Rate limit exceeded (60 req/hour)

Side effects

Mark Session.revokedAt = now() for the matching refresh token (if present).
Clear biore_refresh cookie via Set-Cookie with Max-Age=0.
Audit log: auth.logout.success.

Code samples

curl -X POST https://api.bio.re/api/v1/auth/logout \
  -b cookies.txt -c cookies.txt

async function logout(): Promise<void> {
  await fetch('https://api.bio.re/api/v1/auth/logout', {
    method: 'POST',
    credentials: 'include',
  });
}

import { useMutation, useQueryClient } from '@tanstack/react-query';

export function useLogout() {
  const qc = useQueryClient();
  return useMutation({
    mutationFn: async () => {
      await fetch('/api/v1/auth/logout', {
        method: 'POST',
        credentials: 'include',
      });
    },
    onSettled: () => {
      qc.clear();
      router.push('/login');
    },
  });
}

Try it

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

refreshToken?string

Refresh token (optional — prefer httpOnly cookie)

Response Body

`application/json`

curl -X POST "https://loading/api/v1/auth/logout" \  -H "Content-Type: application/json" \  -d '{}'

{
  "success": true,
  "data": {
    "message": "Operation completed successfully"
  }
}

Source

Source	Path	Lines
Controller	`apps/api-core/src/modules/auth/auth.controller.ts`	`188–202`
DTO (request)	`apps/api-core/src/modules/auth/dto/index.ts`	`103–106` (`LogoutDto`)
Service	`apps/api-core/src/modules/auth/auth.service.ts`	`logout()`
Prisma model	`packages/prisma/prisma/schema.prisma`	`Session.revokedAt`

Logout

200application/json

On this page

`application/json`