Overview
Closes the session for the authenticated user. Since JWT tokens are stateless, this endpoint primarily serves as a confirmation point. The client must discard the token after receiving the response.
The token must be manually removed from client storage (localStorage, cookies, etc.) as JWT tokens cannot be invalidated server-side.
Authentication
Required: Bearer token in Authorization header
Authorization: Bearer < your_jwt_toke n >
Request Body
No request body required.
Response
Indicates if the logout was successful
Always null for logout responses
Examples
curl -X POST "http://localhost:4000/api/auth/logout" \
-H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
-H "Content-Type: application/json"
Response Examples
Success (200 OK)
{
"success" : true ,
"message" : "Sesión cerrada exitosamente" ,
"data" : null
}
Unauthorized (401)
{
"success" : false ,
"message" : "Token no proporcionado o inválido"
}
Error Responses
Status Code Description 401 Missing or invalid token 500 Internal server error
Best Practices
Client-Side Token Management
After a successful logout:
Remove the token from storage (localStorage, sessionStorage, cookies)
Clear any cached user data
Redirect to the login page
Update application state to reflect logged-out status
Consider implementing automatic logout in these scenarios:
Token expiration (24 hours by default)
Inactivity timeout
Multiple failed API requests with 401 status
User account status changes to inactive
Login Authenticate and receive a new token
Get Profile Retrieve user profile information
Source Code Reference
Route: src/routes/auth.routes.js:208
Controller: src/controllers/authController.js:logout