> ## Documentation Index
> Fetch the complete documentation index at: https://rideshare.docs.sumit-dhondikar.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Logout

> Revoke the current refresh token to end the user's session server-side.

End the authenticated session by revoking the refresh token on the server. After a successful logout, the provided refresh token can no longer be used to issue new access tokens.

## Request

**`POST /auth/logout`**

<ParamField body="refreshToken" type="string">
  The refresh token to revoke. Technically optional, but omitting it leaves the token active on the server.
</ParamField>

## Response

<ResponseField name="message" type="string">
  Returns `"Logged out."` regardless of whether a token was provided.
</ResponseField>

## Example

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST http://localhost:8080/auth/logout \
    -H "Content-Type: application/json" \
    -d '{"refreshToken": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4..."}'
  ```

  ```json Response theme={null}
  {
    "message": "Logged out."
  }
  ```
</CodeGroup>

<Note>
  Always include the `refreshToken` in the request body. Without it, the server returns a `200` but the token remains valid and could still be used to generate new access tokens until it expires naturally.
</Note>

## Error codes

| Status | Meaning                                                       |
| ------ | ------------------------------------------------------------- |
| 200    | Logout acknowledged — returned even when no token is provided |