Sign out other sessions
POST /fapi/v1/me/sessions:revoke-others · called from the environment's sign-in host
Ends every active session of the authenticated user except the one making the request, and revokes the user's refresh tokens that are not bound to that session. Access tokens the ended sessions issued are refused, and the applications signed in through them are notified. Requires the authenticated user's __Host-idp_session cookie; if the cookie is missing, expired, or revoked, returns 401 unauthenticated. A first-party app on another origin can instead send its front API access token (Authorization: DPoP <token> with a DPoP proof; see Front API access token). The session must have been verified within the last 300 seconds; otherwise the answer is 401 step_up_required with an RFC 9470 WWW-Authenticate challenge (max_age=300) and nothing changes. Sign in again (for example with max_age=0 or prompt=login) and retry. With no other session the answer is still 204.
Request
Headers:
| Header | Required | Description |
|---|---|---|
Idp-Client |
yes | SDK identifier. |
Origin |
yes | Must be exactly https://<sign-in host>. |
No body.
Response
204 No Content.
Errors
| Status | Code | When |
|---|---|---|
| 401 | unauthenticated |
No valid session cookie. |
| 401 | step_up_required |
The session was verified more than 300 seconds ago. |
| 403 | origin_not_allowed |
Origin is missing or wrong. |
Example
curl -X POST https://example.keenauth.app/fapi/v1/me/sessions:revoke-others \
-H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
-H "Origin: https://example.keenauth.app" \
-b cookies.txt