# /api/auth/logout (dashboard)

Source-derived dashboard endpoint contract, authentication, request validation, responses, and errors.

Source: https://docs.minds.sh/docs/api/platform/reference/dashboard--api-auth-logout



This is the **dashboard** service route. Its origin and authentication are described in [Platform API overview](/docs/api/platform) and [Authentication](/docs/api/platform/authentication). A path shared by another service is a different endpoint.

| Property                       | Contract                                                                       |
| ------------------------------ | ------------------------------------------------------------------------------ |
| Methods                        | POST                                                                           |
| Path                           | `/api/auth/logout`                                                             |
| Path parameters                | None                                                                           |
| Query parameters read in route | None read directly; schema validation below may define additional fields       |
| Headers read in route          | No additional direct header reads; authentication helpers may read credentials |

## Authentication and access [#authentication-and-access]

OAuth browser flow using HTTP-only l1fe\_\* cookies. Exchange/refresh/logout have endpoint-specific inputs and rate limits.

## Method behavior [#method-behavior]

The handler excerpt preserves field validation, response envelopes, cookie changes, and exception branches. Values returned by service helpers retain their named response type above; for passthrough routes, the upstream response is authoritative.

### POST [#post]

```typescript
export async function POST(request: NextRequest): Promise<NextResponse> {
  // Rate limit: 5 logout attempts per minute per IP
  const clientIp = getClientIp(request);
  if (!checkRateLimit(clientIp, 'logout')) {
    return NextResponse.json(
      { error: 'rate_limited', error_description: 'Too many requests. Please try again later.' },
      { status: 429 }
    );
  }

  const cookieStore = await cookies();
  const refreshToken = cookieStore.get('l1fe_refresh_token')?.value;
  const idToken = cookieStore.get('l1fe_id_token')?.value;

  // Step 1: Revoke the refresh token at Auth v4
  if (refreshToken) {
    try {
      await fetch(`${SSO_URL}/v4/oauth/revoke`, {
        method: 'POST',
        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
        body: new URLSearchParams({
          token: refreshToken,
          token_type_hint: 'refresh_token',
          client_id: CLIENT_ID,
        }),
      });
    } catch (err) {
      // Log but don't block logout — the token will expire naturally
      console.error('Token revocation failed:', err);
    }
  }

  // Step 2: Clear all auth cookies
  cookieStore.delete('l1fe_access_token');
  cookieStore.delete('l1fe_refresh_token');
  cookieStore.delete('l1fe_id_token');

  // Step 3: Build Auth v4 logout URL
  const logoutUrl = new URL(`${SSO_URL}/v4/oauth/end_session`);
  if (idToken) {
    logoutUrl.searchParams.set('id_token_hint', idToken);
  }

  const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000';
  logoutUrl.searchParams.set('post_logout_redirect_uri', appUrl);

  return NextResponse.json({ logoutUrl: logoutUrl.toString() });
}
```

Source: `minds-ui/apps/app/app/api/auth/logout/route.ts:24`.

## Response and error branches [#response-and-error-branches]

Literal HTTP statuses in the route: 429. Shared management error classes are defined in [Errors and responses](/docs/api/platform/errors).

```typescript
NextResponse.json(
      { error: 'rate_limited', error_description: 'Too many requests. Please try again later.' },
      { status: 429 }
    )
```

Source: `minds-ui/apps/app/app/api/auth/logout/route.ts:28`.

```typescript
NextResponse.json({ logoutUrl: logoutUrl.toString() })
```

Source: `minds-ui/apps/app/app/api/auth/logout/route.ts:70`.

## Evidence [#evidence]

Generated from the local source snapshot on 2026-09-12. This page documents implemented code and does not certify a deployed service, permissions configuration, or successful provider operation.

Source file: `minds-ui/apps/app/app/api/auth/logout/route.ts`. SHA-256: `0b7fe83d60ff6c44e5dc616f07383cc5850d8110cd9662ebc6ab65ab0f8fe7d8`.