24

I'm using Laravel 7 with Sanctum authentication for my app.
How can i implement the logout procedure?
I use:

Auth::user()->tokens()->delete();

and it works, but It delete all tokens of this user. i would like to delete only the token of the user who requested the logout, in this way the other sessions should remain open

Ersoy
  • 8,816
  • 6
  • 34
  • 48
enfix
  • 6,680
  • 12
  • 55
  • 80

4 Answers4

42

You need to specify the user :

// Revoke a specific user token
Auth::user()->tokens()->where('id', $id)->delete();

// Get user who requested the logout
$user = request()->user(); //or Auth::user()

// Revoke current user token
$user->tokens()->where('id', $user->currentAccessToken()->id)->delete();

Update of Laravel 7, 8, 9, 10 :

// Revoke the token that was used to authenticate the current request...
$request->user()->currentAccessToken()->delete();

// Revoke a specific token...
$user->tokens()->where('id', $tokenId)->delete();
STA
  • 30,729
  • 8
  • 45
  • 59
  • How can I get the token ID? – enfix Jun 21 '20 at 11:37
  • @enfix it would be `Auth::user()->tokens()->where('id', $id)->get('field_name')->first();` the `field_name` is your `column` name where you store token. – STA Jun 21 '20 at 12:04
  • No, I don't know how to set $id variable. is not the id token? – enfix Jun 21 '20 at 12:20
  • @enfix, in this case id and token are not same. If you are logged in user then you can get $id by `$id = Auth::user()->id;` So it would be `Auth::user()->tokens()->where('id', Auth::user()->id)->delete();` – STA Jun 21 '20 at 12:35
  • It don't work: Auth::user()->id is the user ID, not token ID. – enfix Jun 21 '20 at 15:34
  • @enfix, I give you `user ID` not token id – STA Jun 21 '20 at 15:36
  • It' does't work (no error, but nothing appends).I need to identify the specific token to rewoke/delete and not all token about the specific user. – enfix Jun 21 '20 at 15:52
  • 1
    I solve use this solution: Auth::user()->tokens()->where('id', Auth::user()->currentAccessToken()->id)->delete(); – enfix Jun 21 '20 at 16:24
  • Call to undefined method App\User::tokens() – Rejaul Nov 04 '20 at 04:04
  • @Rejaul `App\Models\User::tokens() ` – STA Nov 04 '20 at 04:49
13

For the logout, you can directly delete the token if you use currentAccessToken().

$request->user()->currentAccessToken()->delete();
Pj Salita
  • 131
  • 2
10

To Logout, In laravel 9

   use Laravel\Sanctum\PersonalAccessToken;


   // Get bearer token from the request
    $accessToken = $request->bearerToken();
    
    // Get access token from database
    $token = PersonalAccessToken::findToken($accessToken);

    // Revoke token
    $token->delete();
user311086
  • 920
  • 2
  • 16
  • 29
2

for people who got error regarding currentAccessToken() that null or undefined, don't forget to put your logout route inside auth:sanctum middleware.

so after using

$request->user()->currentAccessToken()->delete();

put the logout route like this:

Route::middleware('auth:sanctum')->group( function () {
    Route::post('logout', [AuthController::class, 'signout']);
});
fajar wz
  • 31
  • 2