Logout method not availiable on local api

[sriechersrc]

Link to reproduction

No response

Environment Info

Binaries:
Node: 22.8.0
npm: 10.8.2
Yarn: N/A
pnpm: 8.12.1
Relevant Packages:
payload: 3.0.0-beta.97
next: 15.0.0-canary.104
@payloadcms/db-mongodb: 3.0.0-beta.97
@payloadcms/email-nodemailer: 3.0.0-beta.97
@payloadcms/graphql: 3.0.0-beta.97
@payloadcms/live-preview: 3.0.0-beta.97
@payloadcms/live-preview-react: 3.0.0-beta.97
@payloadcms/next/utilities: 3.0.0-beta.97
@payloadcms/plugin-cloud: 3.0.0-beta.97
@payloadcms/plugin-cloud-storage: 3.0.0-beta.97
@payloadcms/plugin-nested-docs: 3.0.0-beta.97
@payloadcms/plugin-search: 3.0.0-beta.97
@payloadcms/plugin-seo: 3.0.0-beta.97
@payloadcms/richtext-lexical: 3.0.0-beta.97
@payloadcms/storage-vercel-blob: 3.0.0-beta.97
@payloadcms/translations: 3.0.0-beta.29
@payloadcms/ui/shared: 3.0.0-beta.97
react: 19.0.0-rc-06d0b89e-20240801
react-dom: 19.0.0-rc-06d0b89e-20240801
Operating System:
Platform: darwin
Arch: arm64
Version: Darwin Kernel Version 23.2.0: Wed Nov 15 21:54:51 PST 2023; root:xnu-10002.61.3~2/RELEASE_ARM64_T6030
Available memory (MB): 18432
Available CPU cores: 11

Describe the Bug

I am trying to access a logout method on the local api, however the method does not exist.

const payload = await getPayloadHMR({
  config: configPromise,
})

// Error Property 'logout' does not exist on type 'BasePayload'.  
payload.logout(...)

Is this by design or is the method simply not implemented yet?

Reproduction Steps

See above

Adapters and Plugins

No response

[rilrom]

Currently the documentation across both v2 and v3 shows that logout is not available using the local API. I agree this would be a great addition, would be interested to find out if this was intentional.

[akhrarovsaid]

Hey @sriechersrc,

I believe @rilrom is correct - the docs indicate that the Local API does not have a logout function. See Local API Auth Operations here. I'm not positive about why it is that way, but I'm certain it's for a good technical reason. That being said, I believe this issue belongs more in the Discussions section than as an issue, and maybe as a feature request to make the REST and Local API's more uniform.

As it stands, the way you log a user out is to call the REST API via the /api/<user-collection-slug>/logout endpoint.

[r1tsuu]

We don't use sessions for authentication but JWT tokens and they don't require to manipulate the db in any way for logout. You can call the /api/users/logout endpoint from the frontend which will logout the current user, or in your custom endpoint you can clear the payload_token cookie, example is here https://github.com/payloadcms/payload/blob/beta/packages/next/src/routes/rest/auth/logout.ts

This operation also wouldn't work in server components since you can't set-cookie in them, only in an endpoint / server action.

Converted to a discussion since may be useful for someone.

[tonyjmnz-ss]

the url is broken and there are no hits when searching for payload_token, how would one go about logging out programmatically nowadays?

edit: if anyone stumbles into this, the cookie is payload-token

[tago-SE]

it would be great if the logOut inside useAuth had mode "no-cors" and also supported redirect-responses. This way we could customize the logout endpoint to redirect the user or do whatever we want without having to touch any other logic [assuming that is the only way logOut is being triggered by the framework].

For example:

• If we want to redirect to IDP end_session endpoint or to a custom logout page and perform our own logout from there.
• Right now if the response is a redirect the request in ui/providers/auth does not know what to do with it or if you try to redirect to an external page you will have cors issues.

[K3TH3R]

The other reason that it would be really beneficial for this to be added to the local API is to allow us to do integration tests in unit test frameworks like Vitest/Jest. Right now, I can run my payload instance with a mongodb-memory instance in Vitest, which allows me to do something like this:

beforeEach(async () => {
    const loginResult = await payload.login({
      collection: 'users',
      data: {
        email: regularUser.email,
        password: 'demo',
      }
    })
  })

But then I don't have anyway to then logout those users. I attempted to do something like this:

try {
      const req = await fetch('http://localhost:3000/api/users/logout', {
        method: "POST",
        credentials: "include",
        headers: {
          "Content-Type": "application/json",
        },
      })
      const data = await req.json()
    } catch (err) {
      console.log(err)
    }

But it's throwing a fetch failed error. And there's no apparent way in Payload to be able to see the full resolved path the current instance's api is running on. payload.getAPIUrl() just returns /api for me.