Skip to main content
2026-07-29 16:01
REST API

Logout / Token Revocation

AuthRequestValidateMedium
Try Interactive Demo

What you will learn

  • Logout must REVOKE the session/token server-side — not just delete the cookie client-side
  • After logout, any subsequent request with the old token must 401 immediately, not eventually
  • Test cross-device logout: logging out on device A should invalidate the same account on device B if 'global logout' is the contract

Description

Revoke access and refresh tokens on logout.

Test Scenario

const response = await request.post('/api/v1/auth/logout', {
  headers: { 'Authorization': 'Bearer ' + token }
});
expect(response.status()).toBe(200);
// Token should now be invalid
Endpoint/api/v1/auth/logout

Testing Tips

  • •POST with current token
  • •Verify token is invalidated
  • •Test token after logout fails
// Playwright API Testing - REST
import { test, expect } from '@playwright/test';


test('REST API request', async ({ request }) => {
  const response = await request.get('/api/v1/resource');


  expect(response.ok()).toBeTruthy();
  expect(response.status()).toBe(200);


  const data = await response.json();
  expect(data).toBeDefined();
});

Challenge ID: rest-auth-logout

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/auth/logout

Press Enter to send