Log out

Live

POST/api/v1/auth/logout

Log out — the current refresh token and access token stop working immediately

Headers

Field	Type	Required	Description
Authorization	string	—	Not used — this endpoint is public; no member token required
X-Api-Key	string	Yes	Agent API key (ak_…) from the bo screen
X-Timestamp	string	Yes	Signing time in unix milliseconds (±300s skew allowed)
X-Nonce	string	Yes	Unique per-request value (UUIDv4) for replay protection
X-Signature	string	Yes	hex(HMAC-SHA256(secret, canonical)) — see the Authentication page
X-Player-IP	string	—	The player's real IP (IPv4/IPv6) — recommended (used in login history)
X-Player-UA	string	—	The player's User-Agent (optional — recorded in login history)
X-Request-Id	string	—	Your correlation id — echoed back as request_uuid (recommended)
x-lang	string	—	th (default) or en — the language of message

Request bodyapplication/json

Field	Type	Required	Description
refresh_token	string	—	The refresh token to revoke

Response

Fields in data

Field	Type	Required	Description
revoked	boolean	—	Always true — the endpoint is idempotent; a missing/expired token still counts as logged out

Response example

{
  "success": true,
  "code": 0,
  "message": "สำเร็จ",
  "data": {
    "revoked": true
  },
  "request_uuid": "a92c4e17-8b53-4d06-9e71-3f5b0d8c2a64"
}

Possible error codes

code	Name	HTTP	Message
9003	TOO_MANY_REQUESTS	429	Too many requests. Please slow downAuth-group rate limit exceeded (10 req/min/IP)