> ## Documentation Index
> Fetch the complete documentation index at: https://docs.drssed.app/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /auth/signout — Sign out and invalidate a session

> Sign out by invalidating the refresh token. Requires a valid access token in the Authorization header. Rate limited to 2 requests per minute.

Call `POST /auth/signout` to end a session by permanently invalidating a refresh token. After signing out, the supplied refresh token can no longer be used to obtain new access tokens. Any existing access tokens for the session will continue to work until they expire naturally — if you need to prevent further access immediately, rotate or discard your access token on the client side.

## Endpoint

| Field         | Value              |
| ------------- | ------------------ |
| Method        | `POST`             |
| Path          | `/auth/signout`    |
| Auth required | Yes (Bearer token) |
| Rate limit    | 2 per minute       |

## Request body

<ParamField body="refresh_token" type="string" required>
  The refresh token to invalidate. After this call succeeds, the token cannot be reused.
</ParamField>

## Response

**Status: 204 No Content**

No response body is returned on success.

## Example

```bash cURL theme={null}
curl --request POST \
  --url https://api.drssed.com/auth/signout \
  --header 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' \
  --header 'Content-Type: application/json' \
  --data '{
    "refresh_token": "drt_a1b2c3d4e5f6..."
  }'
```