Logging out

Logout clears the application's identity and visits the provider to clear its authentication session too.

Adding a logout action

Inside a wrapped route:

auth.logout('/signed-out')

The signed-out route displays the result without invoking logout again. Other application session data, such as a shopping basket, remains intact.

Choosing the return destination

Destination precedence is:

1. The explicit logout argument.
2. The configured return URI.
3. The provider's deployment default.

Without either argument, the provider returns to its configured client URI with do=logout. Local authentication is already cleared. Validate destinations supplied through request data against the routes and origins your application permits.

URI objects and query strings

Uri is a string-compatible URI type. Pass a URI or string destination to logout().

auth.logout('?signed-out=1')

At /account?tab=security, this requests /account?signed-out=1. The query-only form uses the current request path even when another return URI is configured.

Session state and redirects

The client clears stored and in-memory authentication before redirecting. The login state is already false when a custom redirect handler runs, and reading the user reports not logged in. The default status is 303. Clearing local data alone does not end the provider session; use logout to visit the provider.

Development users

Users with email Authenticator.FAKE_EMAIL (fakelogin@authwave.com) log out locally without a provider redirect. Fake users with another email follow ordinary provider logout. See Development and testing.

---

Next, see Provider links.