Logout User

End the current authenticated client session and invalidate the active Access Token.

Call this endpoint when the client chooses to sign out. After a successful logout, clear all locally stored credentials and redirect the user to the login flow before making any further protected API requests.

Use Logout User when:

• The client explicitly signs out of your application.
• You need to end the current session for security or account-switch flows.
• You want to invalidate the active Access Token on the server side.
• The application is cleaning up credentials before returning to a public or login screen.

This endpoint does not require a request body.

When logout succeeds, the API confirms that the session has ended.

{
  "success": true,
  "message": "Logged out successfully",
  "data": null,
  "error": null
}

Follow this flow to end a client session safely and return the user to an unauthenticated state.

1. 1

   Confirm the Active Session

   Ensure the client still has a valid Access Token before calling Logout. Use Is Logged In if you need to verify the session first.

2. 2

   Call Logout

   Send a POST request to the Logout endpoint with the Access Token in the Authorization header.

   httpCopy

   Authorization: Bearer <access_token>

3. 3

   Server Ends the Session

   RealtimeX invalidates the current authenticated session so the Access Token can no longer be used for protected requests.

4. 4

   Clear Local Credentials

   Remove the Access Token, Refresh Token, and any cached client session data from your application storage.

5. 5

   Redirect to Login

   Send the client back to the login screen. A new Register Client or Login Client call is required before accessing protected APIs again.

Logout fails when the Access Token is missing, invalid, or already expired.

{
  "success": false,
  "message": "No token, authorization denied",
  "data": null,
  "error": "Unauthorized"
}

• Always clear Access Token and Refresh Token from local storage after a successful logout response.
• Even if the API returns 401 because the token already expired, still clear local credentials and redirect to login.
• Do not keep calling protected APIs after logout until the client authenticates again.
• Use HTTPS for all authentication requests, including logout.
• Prefer a single logout path in your UI so session cleanup stays consistent across the app.