/api/auth/logout (dashboard)
Source-derived dashboard endpoint contract, authentication, request validation, responses, and errors.
This is the dashboard service route. Its origin and authentication are described in Platform API overview and Authentication. A path shared by another service is a different endpoint.
| Property | Contract |
|---|---|
| Methods | POST |
| Path | /api/auth/logout |
| Path parameters | None |
| Query parameters read in route | None read directly; schema validation below may define additional fields |
| Headers read in route | No additional direct header reads; authentication helpers may read credentials |
Authentication and access
OAuth browser flow using HTTP-only l1fe_* cookies. Exchange/refresh/logout have endpoint-specific inputs and rate limits.
Method behavior
The handler excerpt preserves field validation, response envelopes, cookie changes, and exception branches. Values returned by service helpers retain their named response type above; for passthrough routes, the upstream response is authoritative.
POST
export async function POST(request: NextRequest): Promise<NextResponse> {
// Rate limit: 5 logout attempts per minute per IP
const clientIp = getClientIp(request);
if (!checkRateLimit(clientIp, 'logout')) {
return NextResponse.json(
{ error: 'rate_limited', error_description: 'Too many requests. Please try again later.' },
{ status: 429 }
);
}
const cookieStore = await cookies();
const refreshToken = cookieStore.get('l1fe_refresh_token')?.value;
const idToken = cookieStore.get('l1fe_id_token')?.value;
// Step 1: Revoke the refresh token at Auth v4
if (refreshToken) {
try {
await fetch(`${SSO_URL}/v4/oauth/revoke`, {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({
token: refreshToken,
token_type_hint: 'refresh_token',
client_id: CLIENT_ID,
}),
});
} catch (err) {
// Log but don't block logout — the token will expire naturally
console.error('Token revocation failed:', err);
}
}
// Step 2: Clear all auth cookies
cookieStore.delete('l1fe_access_token');
cookieStore.delete('l1fe_refresh_token');
cookieStore.delete('l1fe_id_token');
// Step 3: Build Auth v4 logout URL
const logoutUrl = new URL(`${SSO_URL}/v4/oauth/end_session`);
if (idToken) {
logoutUrl.searchParams.set('id_token_hint', idToken);
}
const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000';
logoutUrl.searchParams.set('post_logout_redirect_uri', appUrl);
return NextResponse.json({ logoutUrl: logoutUrl.toString() });
}Source: minds-ui/apps/app/app/api/auth/logout/route.ts:24.
Response and error branches
Literal HTTP statuses in the route: 429. Shared management error classes are defined in Errors and responses.
NextResponse.json(
{ error: 'rate_limited', error_description: 'Too many requests. Please try again later.' },
{ status: 429 }
)Source: minds-ui/apps/app/app/api/auth/logout/route.ts:28.
NextResponse.json({ logoutUrl: logoutUrl.toString() })Source: minds-ui/apps/app/app/api/auth/logout/route.ts:70.
Evidence
Generated from the local source snapshot on 2026-09-12. This page documents implemented code and does not certify a deployed service, permissions configuration, or successful provider operation.
Source file: minds-ui/apps/app/app/api/auth/logout/route.ts. SHA-256: 0b7fe83d60ff6c44e5dc616f07383cc5850d8110cd9662ebc6ab65ab0f8fe7d8.