Log out
Revokes the current refresh token and clears both session cookies. Idempotent — safe to call when already logged out.
Revokes the current refresh token and clears both session cookies. Idempotent — safe to call when already logged out.
Response Body
application/json
curl -X POST "https://example.com/auth/logout"Start Google login POST
Returns the URL a client should navigate to in order to begin Google OAuth. The URL points to `GET /auth/google`, which redirects the browser to Google's consent screen. After the user consents, the browser is redirected back through `/auth/google/callback` and session cookies are set. For cross-origin SSO, pass `returnTo` (must be allowlisted, or registered to your app via `clientId`) — the callback then redirects to `returnTo?pid_code=...` with a one-time exchange code instead of the wallet. First-time users always land on the PID picker after authenticating (`POST /v1/auth/claim` creates the permanent `<handle>@pid` identity) — handles are only ever chosen there, never up front. Returning logins continue straight to a session.
Rotate the refresh token POST
Rotates the refresh token and issues a fresh access token. The current `pid_refresh` cookie is **invalidated** and replaced with a new one (rotation), so each refresh token can be used exactly once. - 401 if the refresh token is missing, expired, already rotated, or forged. - Rate limited to 10 requests / minute.