25

I'm using Laravel 7 with Sanctum authentication for my app.
How can i implement the logout procedure?
I use:

Auth::user()->tokens()->delete();

and it works, but It delete all tokens of this user. i would like to delete only the token of the user who requested the logout, in this way the other sessions should remain open

4 Answers 4

43

You need to specify the user :

// Revoke a specific user token
Auth::user()->tokens()->where('id', $id)->delete();
// Get user who requested the logout
$user = request()->user(); //or Auth::user()

// Revoke current user token
$user->tokens()->where('id', $user->currentAccessToken()->id)->delete();

Update of Laravel 7, 8, 9, 10 :

// Revoke the token that was used to authenticate the current request...
$request->user()->currentAccessToken()->delete();

// Revoke a specific token...
$user->tokens()->where('id', $tokenId)->delete();
10
  • How can I get the token ID?
    – enfix
    Jun 21, 2020 at 11:37
  • @enfix it would be Auth::user()->tokens()->where('id', $id)->get('field_name')->first(); the field_name is your column name where you store token.
    – STA
    Jun 21, 2020 at 12:04
  • No, I don't know how to set $id variable. is not the id token?
    – enfix
    Jun 21, 2020 at 12:20
  • @enfix, in this case id and token are not same. If you are logged in user then you can get $id by $id = Auth::user()->id; So it would be Auth::user()->tokens()->where('id', Auth::user()->id)->delete();
    – STA
    Jun 21, 2020 at 12:35
  • 1
    I solve use this solution: Auth::user()->tokens()->where('id', Auth::user()->currentAccessToken()->id)->delete();
    – enfix
    Jun 21, 2020 at 16:24
13

For the logout, you can directly delete the token if you use currentAccessToken().

$request->user()->currentAccessToken()->delete();
4
  • 1
    Call to undefined method App\User::currentAccessToken()
    – Rejaul
    Nov 4, 2020 at 3:30
  • add HasApiTokens trait on your User model Jan 5, 2021 at 11:22
  • No dice even with the trait on my request user :/ Apr 6, 2021 at 8:35
  • this also work auth()->user()->tokens()->delete() if you use current AccessToken Feb 16, 2022 at 10:51
9

To Logout, In laravel 9

   use Laravel\Sanctum\PersonalAccessToken;


   // Get bearer token from the request
    $accessToken = $request->bearerToken();
    
    // Get access token from database
    $token = PersonalAccessToken::findToken($accessToken);

    // Revoke token
    $token->delete();
2

for people who got error regarding currentAccessToken() that null or undefined, don't forget to put your logout route inside auth:sanctum middleware.

so after using

$request->user()->currentAccessToken()->delete();

put the logout route like this:

Route::middleware('auth:sanctum')->group( function () {
    Route::post('logout', [AuthController::class, 'signout']);
});
1
  • And don't forget to add the Bearer token to your request
    – timgavin
    Jun 1 at 12:06

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.