# Log out (server-side token revocation)

Canonical page: https://docs.ovok.com/api/authentication/log-out-server-side-token-revocation

`POST /v1/auth/logout`

Signs the caller out on the server: the access token in the `Authorization` header stops working for every authenticated route, although it has not expired.

**Auth:** bearer token. A missing or invalid token gives 401.

## Behaviour

- Ovok adds the token to a denylist. The entry lasts for the rest of the token's lifetime (its `exp` claim), so the list never outgrows the set of live tokens.
- Only this access token is revoked. The refresh token is not touched here; to end other sessions use `DELETE /auth/session/{option}`.
- The call is idempotent: repeating it with the same token returns 204 with no further effect. A token without an `exp` claim, or one that has already expired, is ignored.
- If the denylist store is unavailable the call still returns 204, and the token stays valid until it expires. Clear the local session as well.
- The response has no body (204 No Content).
- The route is available at both `/auth/logout` and `/v1/auth/logout`.

## Example

```bash
curl -X POST 'https://api.sandbox.ovok.com/v1/auth/logout' \
  -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjcyNjg4MDAsImV4cCI6MTc2NzI3MjQwMH0.Ql3B_ztDvctlyZ2z0vp4sl3ExXRQGkzmxdmTAqxNzZk'
```