Skip to main content
POST
/
api
/
auth
/
logout
Logout
curl --request POST \
  --url https://api.example.com/api/auth/logout
{
  "success": true,
  "message": "<string>",
  "data": null
}

​
Overview

Closes the session for the authenticated user. Since JWT tokens are stateless, this endpoint primarily serves as a confirmation point. The client must discard the token after receiving the response.
The token must be manually removed from client storage (localStorage, cookies, etc.) as JWT tokens cannot be invalidated server-side.

​
Authentication

Required: Bearer token in Authorization header 
Authorization: Bearer <your_jwt_token>

​
Request Body

No request body required.

​
Response

​
success
boolean
Indicates if the logout was successful
​
message
string
Confirmation message
​
data
null
Always null for logout responses

​
Examples

curl -X POST "http://localhost:4000/api/auth/logout" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -H "Content-Type: application/json"

​
Response Examples

​
Success (200 OK)

{
  "success": true,
  "message": "Sesión cerrada exitosamente",
  "data": null
}

​
Unauthorized (401)

{
  "success": false,
  "message": "Token no proporcionado o inválido"
}

​
Error Responses

Status CodeDescription
401Missing or invalid token
500Internal server error

​
Best Practices

After a successful logout:
  1. Remove the token from storage (localStorage, sessionStorage, cookies)
  2. Clear any cached user data
  3. Redirect to the login page
  4. Update application state to reflect logged-out status
Consider implementing automatic logout in these scenarios:
  • Token expiration (24 hours by default)
  • Inactivity timeout
  • Multiple failed API requests with 401 status
  • User account status changes to inactive

Login

Authenticate and receive a new token

Get Profile

Retrieve user profile information

​
Source Code Reference

  • Route: src/routes/auth.routes.js:208
  • Controller: src/controllers/authController.js:logout