Sign out a session
POST /fapi/v1/me/sessions/{session_id}:revoke · called from the environment's sign-in host
Ends one of the authenticated user's other sessions. Its refresh tokens are revoked, the access tokens it issued are refused, and the applications signed in through it are notified. The session making the request cannot be ended here; sign out of this browser with the logout endpoint (/oauth2/logout), which also clears the cookie. Requires the authenticated user's __Host-idp_session cookie; if the cookie is missing, expired, or revoked, returns 401 unauthenticated. A first-party app on another origin can instead send its front API access token (Authorization: DPoP <token> with a DPoP proof; see Front API access token). The session must have been verified within the last 300 seconds; otherwise the answer is 401 step_up_required with an RFC 9470 WWW-Authenticate challenge (max_age=300) and nothing changes. Sign in again (for example with max_age=0 or prompt=login) and retry. A session of the user that has already ended answers 204 and nothing changes.
Request
Headers:
| Header | Required | Description |
|---|---|---|
Idp-Client |
yes | SDK identifier. |
Origin |
yes | Must be exactly https://<sign-in host>. |
session_id: the session identifier returned by GET /fapi/v1/me/sessions (ses_…).
No body.
Response
204 No Content.
Errors
| Status | Code | When |
|---|---|---|
| 401 | unauthenticated |
No valid session cookie. |
| 401 | step_up_required |
The session was verified more than 300 seconds ago. |
| 403 | origin_not_allowed |
Origin is missing or wrong. |
| 404 | not_found |
No such session for this user (an unknown, malformed or another user's identifier answers the same). |
| 409 | conflict |
The identifier is the session making the request. |
Example
curl -X POST https://example.keenauth.app/fapi/v1/me/sessions/ses_01jbz6x8kq3m2n4p5r6s7t8v9w:revoke \
-H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
-H "Origin: https://example.keenauth.app" \
-b cookies.txt