POST /api/token/invalidate

Logs the user out by invalidating their refresh token. The JWT access token (short-lived) cannot be revoked: the client deletes it on its side.

Endpoint

POST /api/token/invalidate

Accessible without an access token (a user whose JWT has expired must still be able to log out).

The refresh token is read first from the httpOnly REFRESH_TOKEN cookie set at login; failing that, from the body:

{
    "refresh_token": "string"
}

Field	Type	Required	Description
refresh_token	string	No	Refresh token to invalidate, if the cookie is not sent

Code: 200 OK

{
    "message": "Déconnexion réussie"
}

The call succeeds even if the token has already expired or is unknown. The logout is recorded in the audit log.

curl -X POST https://sig.example.org/api/token/invalidate \
  -H "Content-Type: application/json" \
  --cookie "REFRESH_TOKEN=…"

await fetch('/api/token/invalidate', { method: 'POST', credentials: 'include' });
localStorage.removeItem('token');