PandaIDX

Log Out Visitor

Signs a visitor out by revoking their refresh token and every token issued from the same sign in. Call it when the visitor clicks Log out, then discard both tokens.

POST/v1/auth/logout

Authentication

Public key?key=pk_…

Public key in the `key` query parameter. No OAuth, no secret.

Edge cache: no-store

Query Parameters

keystring
required

The site's public key (pk_…). It selects the account. Safe to ship to the browser.

Body Parameters

refreshTokenstring
required

The refresh token you got from sign up, login or refresh.

Responses

200Success
application/json
typestring

Errors

401Missing or invalid public key.
403The Panda account is not active. The body also carries `code: "TENANT_INACTIVE"`.

Notes

  • It always answers `success`, even when the refresh token is unknown or already revoked.
  • The access token is a signed token that is not checked against a list, so it keeps working until it expires (up to 1 hour). Delete it on the client.
Request
curl --request POST \
  --url "https://api.pandaidx.com/v1/auth/logout?key={{public_key}}" \
  --header "Content-Type: application/json" \
  --data '{"refreshToken":"example-refresh-token"}'
Response200 OK
{
  "type": "success"
}