> For the complete documentation index, see [llms.txt](https://onchainlabs-tech-documentation.gitbook.io/wallettwo-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://onchainlabs-tech-documentation.gitbook.io/wallettwo-documentation/actions/logout.md).

# Logout

**Endpoint:** `/action/logout`

Terminates the currently active WalletTwo user session and notifies the host page. Use this action when your application needs to trigger a WalletTwo sign-out as part of your own sign-out flow — for example, when the user logs out of your platform and you want to clean up the embedded wallet session at the same time.

***

### Required user state

| Check             | Middleware                | Redirects to if missing |
| ----------------- | ------------------------- | ----------------------- |
| User is logged in | `LoggedMiddleware`        | `/auth/login`           |
| Email is verified | `EmailVerifiedMiddleware` | `/auth/email/verify`    |
| Wallet is created | `WalletMiddleware`        | `/auth/wallet/register` |

***

### Iframe URL

```
https://<WALLETTWO_ORIGIN>/action/logout?iframe=true
```

Optional parameters:

| Param          | Required            | Type                    | Description                                                   |
| -------------- | ------------------- | ----------------------- | ------------------------------------------------------------- |
| `redirect_uri` | No                  | `string` (absolute URL) | If provided, the iframe navigates here after logout completes |
| `iframe`       | Yes (for embedding) | `"true"`                | Activates bare rendering mode                                 |

Full example:

```
https://<WALLETTWO_ORIGIN>/action/logout?iframe=true&redirect_uri=https%3A%2F%2Fexample.com%2Fsigned-out
```

***

### What happens when the action runs

1. On mount, `logout()` is called immediately (no user confirmation prompt).
2. Regardless of whether logout succeeds or fails, `window.parent.postMessage(...)` is fired.
3. If `redirect_uri` is present, the iframe navigates to that URL.
4. While waiting, a centered loading spinner is shown.

The logout always completes silently from the user's perspective. Errors are logged to the browser console only.

***

### postMessage event

Fired to `window.parent` after the logout attempt finishes (whether it succeeded or failed):

```js
{
  event: "wallet_logout",
  type: "wallet_logout"
}
```

| Field   | Description                                         |
| ------- | --------------------------------------------------- |
| `event` | Always `"wallet_logout"`                            |
| `type`  | Always `"wallet_logout"` (legacy alias, same value) |

There is no success/failure distinction in the event. If your application needs to confirm the logout actually succeeded, use the `redirect_uri` path together with a server-side session check.

***

### redirect\_uri callback

The iframe navigates to `redirect_uri` with no additional query params appended:

```
https://example.com/signed-out
```

***

### Host page integration

#### Option A: postMessage only

```html
<iframe
  id="w2-logout"
  src="https://<WALLETTWO_ORIGIN>/action/logout?iframe=true"
  style="width:1px;height:1px;border:0;visibility:hidden;"
></iframe>

<script>
  const WALLET_TWO_ORIGIN = "https://<WALLETTWO_ORIGIN>";

  window.addEventListener("message", (event) => {
    if (event.origin !== WALLET_TWO_ORIGIN) return;

    if (event.data?.event === "wallet_logout") {
      // Session is cleared, clean up your own state
      clearLocalSession();
      window.location.href = "/signed-out";
    }
  });
</script>
```

#### Option B: redirect\_uri

If you prefer not to use `postMessage`, pass a `redirect_uri` to your own page and handle the arrival there:

```
/action/logout?iframe=true&redirect_uri=https%3A%2F%2Fexample.com%2Flogout-complete
```

When the iframe lands on `https://example.com/logout-complete`, your server can clear the session cookie and redirect the top-level page as needed.

***

### Triggering logout programmatically from the parent page

You can create the logout iframe dynamically when a user signs out of your platform, without keeping it in the DOM at all times:

```js
function triggerWalletTwoLogout() {
  return new Promise((resolve) => {
    const WALLET_TWO_ORIGIN = "https://<WALLETTWO_ORIGIN>";

    const iframe = document.createElement("iframe");
    iframe.style.display = "none";
    iframe.src = `${WALLET_TWO_ORIGIN}/action/logout?iframe=true`;
    document.body.appendChild(iframe);

    const timeout = setTimeout(() => {
      cleanup();
      resolve(); // Proceed even if no event arrives
    }, 5000);

    function onMessage(event) {
      if (event.origin !== WALLET_TWO_ORIGIN) return;
      if (event.data?.event !== "wallet_logout") return;
      cleanup();
      resolve();
    }

    function cleanup() {
      clearTimeout(timeout);
      window.removeEventListener("message", onMessage);
      document.body.removeChild(iframe);
    }

    window.addEventListener("message", onMessage);
  });
}
```

***

### Notes

* The action logs out the user immediately on mount without any confirmation step. Do not navigate to this route unless you intend to end the session.
* Logout errors are swallowed silently in the UI. Even if the server-side logout call fails, the `wallet_logout` event is still fired.
* After logout, if the user navigates to any `/action/*` or `/wallet/*` route, they will be redirected to `/auth/login` by `LoggedMiddleware`.