Logout
auth
Logout
Revoke current session.
Requires auth (Bearer token). Optionally accepts a refresh_token body to also revoke the outstanding refresh grant. In this in-memory impl the refresh token is simply marked revoked. In production: UPDATE refresh_tokens SET revoked_at=now() + Redis revocation set.
POST
Logout