Revoke my session
Logs out by permanently deleting the session. The `__nextgen_session` cookie issued at creation (or superseded by a handoff exchange) is required. Idempotent: if the session is already gone this still returns 204. Any tokens derived from the session are invalidated, and the cookie itself is cleared in the response.
Logs out by permanently deleting the session.
The __nextgen_session cookie issued at creation (or superseded by a handoff
exchange) is required. Idempotent: if the session is already gone this still
returns 204. Any tokens derived from the session are invalidated, and the
cookie itself is cleared in the response.
nextgenSession__nextgen_session<token>The __nextgen_session cookie issued at session creation or superseding handoff exchange.
A missing or invalid cookie yields 401 with code auth.unauthorized and the message
Missing or invalid session token.
Cross-site request forgery (ADR 053 §5): a state-changing request that this
cookie authenticates must come from the same origin — a cross-site browser
request is refused with 403 and code auth.csrf_invalid. Every such
request must also send the session's token from GET /sessions/me/csrf in the
X-Zitadel-CSRF header, or it answers the same 403. The only exceptions are
sign-out (revokeMySession) and the POST …/query reads, which need no
token. Safe methods (GET) are not checked. A request a project secret
authenticates is not affected.
Session deleted; cookie cleared. Idempotent — also returned when the session was already absent.
curl -X DELETE 'https://example.com/sessions/me'