signOut

Complete API reference for the api.signOut method, handling cookie destruction, back-channel token invalidation, and secure redirection.

The api.signOut method signs out the current user: it invalidates the session token and clears the session cookie. This method runs on the server, so it requires you to pass the request or headers object from your server-side context.

sign-out.ts

import { api } from "@/lib/auth"

const output = await api.signOut({
  headers: getHeaders(),
  redirectTo: "/login",
})

Reference

Parameters

Parameter	Type	Required	Description
options	`SignOutAPIOptions`	No	An object containing additional options for the sign-out process.

SignOutAPIOptions

Option	Type	Default	Description
request	`Request`	undefined	The request object from the server-side context.
headers	`Headers`	undefined	The headers object from the server-side context.
redirect	`boolean`	`true`	Whether to redirect via the `Location` header (`true`) or return the result as an object (`false`).
redirectTo	`string`	undefined	The URL to redirect to after sign-out completes.
~~skipCSRFCheck~~	`boolean`	`false`	~~Deprecated~~. This option has been replaced by `doubleSubmitToken` and will be removed in a future release.
doubleSubmitToken	`string`	undefined	Optional CSRF token used to explicitly enable Double-Submit Cookie validation for server-side API functions.

Returns

Return Type	Description
`Promise<SignOutAPIReturn>`	Resolves to an object containing `redirectURL`, `redirect`, and `success`.

Behavior

The doubleSubmitToken option enables Double-Submit Cookie validation when calling Aura Auth server-side API functions. By default, API functions execute in a trusted server environment, where browser-based CSRF attacks are not possible because requests originate from server-side code rather than from a user's browser. For that reason, Aura Auth performs the standard CSRF validation but skips the additional Double-Submit Cookie verification.

This option is intended for advanced scenarios where server-side requests should enforce the same CSRF guarantees as browser-initiated requests.

Providing doubleSubmitToken does not replace or disable CSRF protection. It enables the additional Double-Submit Cookie validation on top of the standard CSRF checks already performed by Aura Auth.
The return value depends on the redirect option:
- redirect: true (default) — redirects to redirectTo (or the default post-sign-out URL) via the Location header.
- redirect: false — resolves to an object with redirectURL, redirect: false, and success, letting you handle navigation yourself.
If sign-out fails (e.g. missing or mismatched CSRF token, or no active session to invalidate), redirectURL resolves to null and success is false.

Usage

Sign out

sign-out.ts

import { api } from "@/lib/auth"

const output = await api.signOut({
  headers: getHeaders(),
  redirectTo: "/login",
})

manual-navigation.ts

import { api } from "@/lib/auth"

const output = await api.signOut({
  headers: getHeaders(),
  redirect: false,
})

if (output.success) {
  redirect(output.redirectURL)
}

double-submit.ts

import { api } from "@/lib/auth"

const output = await api.signOut({
  headers: getHeaders(),
  redirectTo: "/login",
  doubleSubmitToken: getDoubleSubmitTokenFromRequest(),
})