> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Arvo-AI/aurora/llms.txt
> Use this file to discover all available pages before exploring further.

# Logout

> End user session and clear authentication

## Overview

Aurora uses Auth.js (NextAuth.js) for session management. Logout is handled entirely on the client side through Auth.js, and does not require a backend API endpoint.

## Client-Side Logout

To log out a user, use the Auth.js `signOut` function:

```typescript theme={null}
import { signOut } from "next-auth/react"

// Simple logout (redirects to home)
await signOut()

// Logout with custom redirect
await signOut({ callbackUrl: '/sign-in' })

// Logout without redirect
await signOut({ redirect: false })
```

## Full Example

```typescript theme={null}
import { signOut } from "next-auth/react"
import { useRouter } from "next/navigation"

function LogoutButton() {
  const router = useRouter()
  
  const handleLogout = async () => {
    try {
      await signOut({ 
        redirect: false 
      })
      
      // Optionally clear any local state
      localStorage.clear()
      
      // Navigate to sign-in page
      router.push('/sign-in')
    } catch (error) {
      console.error('Logout failed:', error)
    }
  }
  
  return (
    <button onClick={handleLogout}>
      Sign Out
    </button>
  )
}
```

## What Happens During Logout

1. **Session Cleared**: Auth.js clears the session from cookies/storage
2. **Token Invalidated**: The session token is removed
3. **Client State Reset**: User authentication state is cleared
4. **Redirect** (optional): User is redirected to the specified URL

## Session Cleanup

Auth.js automatically handles:

* Clearing session cookies
* Removing JWT tokens
* Invalidating the session on the server
* Broadcasting logout to all tabs (if configured)

## API Integration

After logout:

* The `X-User-ID` header will no longer be sent with requests
* API endpoints requiring authentication will return `401 Unauthorized`
* User must log in again to access protected resources

## Security Considerations

### Client-Side Logout

While logout is client-side, the session token is invalidated and cannot be reused.

### Session Expiration

Sessions automatically expire based on Auth.js configuration. Default settings:

* **Session Max Age**: 30 days (configurable)
* **Idle Timeout**: Session expires after inactivity period

### Multiple Devices

Logging out on one device does not automatically log out other devices. To implement global logout:

1. Store session IDs in the database
2. Invalidate all sessions on logout
3. Check session validity on each request

## Example: Logout with Confirmation

```typescript theme={null}
import { signOut } from "next-auth/react"

function LogoutWithConfirmation() {
  const handleLogout = async () => {
    const confirmed = confirm('Are you sure you want to sign out?')
    
    if (confirmed) {
      await signOut({
        callbackUrl: '/sign-in',
        redirect: true
      })
    }
  }
  
  return (
    <button 
      onClick={handleLogout}
      className="text-red-600 hover:text-red-800"
    >
      Sign Out
    </button>
  )
}
```

## Troubleshooting

### Logout Not Working

If logout fails to clear the session:

1. Check Auth.js configuration in `app/api/auth/[...nextauth]/route.ts`
2. Verify cookies are being cleared in browser DevTools
3. Ensure the callback URL is allowed in Auth.js config
4. Check for errors in the browser console

### Session Persists After Logout

If the session persists:

1. Clear browser cookies manually
2. Check for custom session storage logic
3. Verify Auth.js session callbacks are configured correctly

## Related Documentation

<CardGroup cols={2}>
  <Card title="Login" icon="right-to-bracket" href="/api/auth/login">
    Authenticate users
  </Card>

  <Card title="Authentication Overview" icon="shield" href="/api/auth/overview">
    Learn about authentication
  </Card>
</CardGroup>