Log out
Revokes the current refresh token and clears both session cookies. Idempotent — safe to call when already logged out.
Revokes the current refresh token and clears both session cookies. Idempotent — safe to call when already logged out.
Response Body
application/json
curl -X POST "https://example.com/auth/logout"Start Google login POST
Returns the URL a client should navigate to in order to begin Google OAuth. The URL points to `GET /auth/google`, which redirects the browser to Google's consent screen. After the user consents, the browser is redirected back through `/auth/google/callback` and session cookies are set.
Rotate the refresh token POST
Rotates the refresh token and issues a fresh access token. The current `peridot_refresh` cookie is **invalidated** and replaced with a new one (rotation), so each refresh token can be used exactly once. - 401 if the refresh token is missing, expired, already rotated, or forged. - Rate limited to 10 requests / minute.