# Cancel the current sign-in transaction

`POST /fapi/v1/transactions/current:cancel` · called from the environment's sign-in host

Cancels the current transaction. The transaction moves to the `failed` state and the transaction cookie is removed.

## Request

Headers:

| Header | Required | Description |
| --- | --- | --- |
| `Idp-Client` | yes | SDK identifier. |
| `Origin` | yes | Must be exactly `https://<sign-in host>`. |
| `Idp-Csrf-Token` | yes | The `csrf_token` from the transaction object. |

No body.

## Response

`200 OK` with the cancelled transaction.

## DPoP-bound headless transactions

For a transaction started with a `DPoP` header, send a new proof from the same key (`htm` `POST`, `htu` this URL)
instead of `Idp-Csrf-Token`.

## Errors

| Status | Code | When |
| --- | --- | --- |
| 403 | `origin_not_allowed` | `Origin` or `Idp-Csrf-Token` is missing or wrong. |
| 409 | `transaction_state_conflict` | The transaction can no longer be cancelled. |
| 410 | `transaction_expired` | The transaction has ended. |
| 401 | `invalid_dpop_proof` | The `DPoP` proof is invalid or reused. |

## Example

```bash
curl -X POST https://example.keenauth.app/fapi/v1/transactions/current:cancel \
  -H "Idp-Client: my-app/1.0.0 (node/22.0.0)" \
  -H "Origin: https://example.keenauth.app" \
  -H "Idp-Csrf-Token: $CSRF_TOKEN" \
  -b cookies.txt
```