API ReferenceGeneratedAuth

Sign out (end the session)

Ends the session the presented token belongs to: its refresh token and all of its access tokens stop working immediately. Send the refresh token as `refreshToken` in the body (preferred — it works after the access token has expired), or the access token as `Authorization: Bearer <token>`. When a body refresh token is present, the header is ignored. Idempotent: signing out of a session that has already ended returns 200.

DELETE
/{appUid}/auth/logout

Path Parameters

appUid*string

Your app's unique id. Find it in the console under the app's Settings, or in the URL of any app page.

Formatuuid

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/497f6eca-6276-4993-bfeb-53cbbbba6f08/auth/logout" \  -H "Content-Type: application/json" \  -d '{}'
{  "msg": "Signed out"}

Logs a user in

Log a user in

Email a 6-digit sign-in code

Returns an opaque `requestId` — the half the client keeps — and emails the code. An address with no account still gets a requestId (a decoy that resolves to no row), so the response shape never differs. The code is stored only as a salted digest and is attempt-capped.