How to logout a user from API using laravel Passport

You need to delete the token from the database table oauth_access_tokens you can do that by creating a new model like OauthAccessToken

1. Run the command php artisan make:model OauthAccessToken to create the model.

2. Then create a relation between the User model and the new created OauthAccessToken Model , in User.php add :

   public function AauthAcessToken(){
       return $this->hasMany('\App\OauthAccessToken');
   }
   

3. in UserController.php , create a new function for logout:

   public function logoutApi()
   { 
       if (Auth::check()) {
          Auth::user()->AauthAcessToken()->delete();
       }
   }
   

4. In api.php router , create new route :

    Route::post('logout','UserController@logoutApi');
   

5. Now you can logout by calling posting to URL /api/logout

This is sample code i'm used for log out

public function logout(Request $request)
{
    $request->user()->token()->revoke();
    return response()->json([
        'message' => 'Successfully logged out'
    ]);
}

Create a route for logout:

$router->group(['middleware' => 'auth:api'], function () use ($router) {
    Route::get('me/logout', 'UserController@logout');
});

Create a logout function in userController ( or as mentioned in your route)

public function logout() {
        $accessToken = Auth::user()->token();
        DB::table('oauth_refresh_tokens')
            ->where('access_token_id', $accessToken->id)
            ->update([
                'revoked' => true
            ]);

        $accessToken->revoke();
        return response()->json(null, 204);
    }

I am using Laravel 6.12.0, below function is working for me.

public function logout(Request $request){
            $accessToken = Auth::user()->token();
            $token= $request->user()->tokens->find($accessToken);
            $token->revoke();
            $response=array();
            $response['status']=1;
            $response['statuscode']=200;
            $response['msg']="Successfully logout";
            return response()->json($response)->header('Content-Type', 'application/json');
        }

This is my first post.. and i find a clean solution (Laravel last Version)

/**
 * Logout api
 *
 * @return \Illuminate\Http\Response
 */
public function logout(Request $request)
{        
    if (Auth::check()) {
        $token = Auth::user()->token();
        $token->revoke();
        return $this->sendResponse(null, 'User is logout');
    } 
    else{ 
        return $this->sendError('Unauthorised.', ['error'=>'Unauthorised'] , Response::HTTP_UNAUTHORIZED);
    } 
}

Below is the simplest way I found to do it.

1. USE database SESSION INSTEAD OF file SESSION

Official documention

php artisan session:table
php artisan migrate

Replace SESSION_DRIVER=file by SESSION_DRIVER=database in your .env file.

2. DELETE USER SESSION RIGHT AFTER LOGIN

After a user is redirected to your frontend and logs in to finally get a token, you probably call a route in api/routes.php to get the user information, that's where I'm closing the user backend session before sending back user information to the frontend:

Route::middleware('auth:api')->get('/user', function (Request $request) {
    // Close user session here
    Illuminate\Support\Facades\DB::table('sessions')
        ->whereUserId($request->user()->id)
        ->delete();
    return $request->user();
});

3. REVOKE TOKENS AT LOGOUT

Then, to "log out" (actually, revoke tokens) the user from the frontend, you just need to call another route to revoke the token and refresh_token:

Route::middleware('auth:api')->post('/logout', function (Request $request) {
    // Revoke access token
    // => Set oauth_access_tokens.revoked to TRUE (t)
    $request->user()->token()->revoke();

    // Revoke all of the token's refresh tokens
    // => Set oauth_refresh_tokens.revoked to TRUE (t)
    $refreshTokenRepository = app('Laravel\Passport\RefreshTokenRepository');
    $refreshTokenRepository->revokeRefreshTokensByAccessTokenId($request->user()->token()->id);

    return;
});

You may prefer to put these two closures in the UserController.

Hope help someone:

 if (Auth::check()) {
   $request->user()->tokens->each(function ($token, $key) {
        $token->delete();
    });
 }

Good Luck.

I use this in my project to logout from multiple device.

public function logout(Request $request, $devices = FALSE)
{
    $this->logoutMultiple(\Auth::user(), $devices);
    return response()->json([], 204);
}

private function logoutMultiple(\App\Models\User $user, $devices = FALSE)
{

    $accessTokens = $user->tokens();

    if ($devices == 'all') {
        
    } else if ($devices == 'other') {
        $accessTokens->where('id', '!=', $user->token()->id);
    } else {
        $accessTokens->where('id', '=', $user->token()->id);
    }

    $accessTokens = $accessTokens->get();

    foreach ($accessTokens as $accessToken) {

        $refreshToken = \DB::table('oauth_refresh_tokens')
            ->where('access_token_id', $accessToken->id)
            ->update(['revoked' => TRUE]);

        $accessToken->revoke();
    }
}

Try this code to help you to logout from passport authentication.

Route::post('/logout', function(){

        if (Auth::check()) {
            Auth::user()->AauthAcessToken()->delete();
        }

        return response()->json([

            'status'    => 1,
            'message'   => 'User Logout',

        ], 200);
    });

check whether your model contains OauthAccessToken which needs to connect with the database oauth_access_tokens. The access token is stored in the database table oauth_access_tokens. and makes a relation from users to oauth_access_tokens.

public function AauthAcessToken(){
    return $this->hasMany(OauthAccessToken::class);
}