> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Logout user

> Logout the current client session.

Web clients use the httpOnly refresh token cookie. If a valid web refresh cookie is present,
the request must include the `X-CSRF-Token` header returned from login, registration, or refresh.
Missing, expired, invalid, or wrong-session-type refresh cookies are cleared idempotently and still
return success. Mobile, desktop, and server clients do not have server-side logout state and should
discard their stored refresh token after this request.




## OpenAPI

````yaml https://raw.githubusercontent.com/InsForge/InsForge/main/openapi/auth.yaml post /api/auth/logout
openapi: 3.0.3
info:
  title: Insforge Authentication API
  version: 2.0.0
  description: Authentication endpoints with separated auth and profile tables
servers: []
security: []
paths:
  /api/auth/logout:
    post:
      tags:
        - Client
      summary: Logout user
      description: >
        Logout the current client session.


        Web clients use the httpOnly refresh token cookie. If a valid web
        refresh cookie is present,

        the request must include the `X-CSRF-Token` header returned from login,
        registration, or refresh.

        Missing, expired, invalid, or wrong-session-type refresh cookies are
        cleared idempotently and still

        return success. Mobile, desktop, and server clients do not have
        server-side logout state and should

        discard their stored refresh token after this request.
      parameters:
        - name: client_type
          in: query
          schema:
            type: string
            enum:
              - web
              - mobile
              - desktop
              - server
            default: web
          description: >-
            Client type. Web clients clear the httpOnly refresh cookie; other
            clients should discard their local refresh token.
        - name: X-CSRF-Token
          in: header
          schema:
            type: string
          description: >-
            CSRF token required for web clients when a valid refresh cookie is
            present
      responses:
        '200':
          description: >-
            Logged out successfully. Also returned when the refresh cookie is
            missing, expired, invalid, or the wrong session type.
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                  message:
                    type: string
        '403':
          description: Invalid or missing CSRF token for a valid web refresh cookie

````