Logout now requires Authorization: Bearer <access-token>.

2026-08-26 20:46:48 +02:00
parent 16c9c3a03f
commit b4b40e5c2c
9 changed files with 40 additions and 14 deletions
@@ -275,6 +275,13 @@ curl -X POST http://localhost:8000/api/auth/refresh \\

 Refresh-token reuse or a mismatched device ID returns `401` and revokes the token family. Signing out revokes the token family, while changing the password or completing a password reset revokes all sessions for the user.

+Sign out with the access token in the bearer header:
+
+```sh
+curl -X POST http://localhost:8000/api/auth/logout \\
+  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
+```
+
 Submit a link using the returned access token:

 ```sh