Fac-360
Identity

Log out everywhere

Revokes every session of the caller, this one included. Needs a live session of its own, so it cannot be aimed at another user.

DELETE
/console/v1/sessions

Revokes every session of the caller, this one included. Needs a live session of its own, so it cannot be aimed at another user.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X DELETE "https://example.com/console/v1/sessions" \  -H "Authorization: Bearer apf_v2_tu_credencial"
Empty

Log in POST POST

Sets the session cookie. When the account has TOTP enrolled and no totpCode was supplied -- or the code was replayed -- the answer is 401 MFA_REQUIRED and NO cookie; resend the same body with the code. There is no intermediate ticket, because a ticket is a second session-shaped secret with its own theft story. Every failure below a correct password is one indistinguishable 401 that costs one Argon2id verification, including for an address that was never registered.

Log out DELETE DELETE

Revokes this session server-side and clears the cookie. The token is opaque and server-side precisely so this can be instantaneous rather than a matter of waiting for an expiry.