# Sign out a session

`POST /fapi/v1/me/sessions/{session_id}:revoke` · called from the environment's sign-in host

Ends one of the authenticated user's other sessions. Its refresh tokens are revoked, the access tokens it issued are refused, and the applications signed in through it are notified. The session making the request cannot be ended here; sign out of this browser with the logout endpoint (`/oauth2/logout`), which also clears the cookie. Requires the authenticated user's `__Host-idp_session` cookie; if the cookie is missing, expired, or revoked, returns `401 unauthenticated`. A first-party app on another origin can instead send its front API access token (`Authorization: DPoP <token>` with a DPoP proof; see [Front API access token](/docs/api/fapi/front-api-token)). The session must have been verified within the last 300 seconds; otherwise the answer is `401 step_up_required` with an RFC 9470 `WWW-Authenticate` challenge (`max_age=300`) and nothing changes. Sign in again (for example with `max_age=0` or `prompt=login`) and retry. A session of the user that has already ended answers `204` and nothing changes.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |

`session_id`: the session identifier returned by `GET /fapi/v1/me/sessions` (`ses_…`).

No body.

## Response

`204 No Content`.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 401 | `unauthenticated` | No valid session cookie. |
| 401 | `step_up_required` | The session was verified more than 300 seconds ago. |
| 403 | `origin_not_allowed` | `Origin` is missing or wrong. |
| 404 | `not_found` | No such session for this user (an unknown, malformed or another user's identifier answers the same). |
| 409 | `conflict` | The identifier is the session making the request. |

## Example

```bash
curl -X POST https://example.keenauth.app/fapi/v1/me/sessions/ses_01jbz6x8kq3m2n4p5r6s7t8v9w:revoke \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -b cookies.txt
```