# Sign out other sessions

`POST /fapi/v1/me/sessions:revoke-others` · called from the environment's sign-in host

Ends every active session of the authenticated user except the one making the request, and revokes the user's refresh tokens that are not bound to that session. Access tokens the ended sessions issued are refused, and the applications signed in through them are notified. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)). The session must have been verified within the last 300 seconds; otherwise the answer is `401 step_up_required` with an RFC 9470 `WWW-Authenticate` challenge (`max_age=300`) and nothing changes. Sign in again (for example with `max_age=0` or `prompt=login`) and retry. With no other session the answer is still `204`.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |

No body.

## Response

`204 No Content`.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |
| 401 | `step_up_required` | The session was verified more than 300 seconds ago. |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |

## Example

```bash
curl -X POST https://example.keenauth.app/fapi/v1/me/sessions:revoke-others \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -b cookies.txt
```