Inside a browser context, signOut() will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a "SIGNED_OUT" event.
For server-side management, you can revoke all refresh tokens for a user by passing a user's JWT through to auth.api.signOut(JWT: string).
There is no way to revoke a user's access token jwt until it expires. It is recommended to set a shorter expiry on the jwt for this reason.
signOut behavior depends on the selected scope:
local: The local session is removed first and a SIGNED_OUT event is fired, then the client makes a best-effort request to revoke the refresh token on the server. If the request fails, the client is still signed out locally and the error is returned, but the server may retain the refresh token until it expires.
global: All of the user's sessions are first invalidated on the server. Once the server acknowledges the request, the local session is cleared. If server logout fails, the local session is retained, no SIGNED_OUT event is triggered, and the server or network error is returned. A 401, 403, or 404 response counts as a successful sign-out.
others: All other sessions are invalidated when the server accepts the request; the current local session remains unchanged. In case of server or network failures, the error is returned. A SIGNED_OUT event is never triggered, regardless of the outcome.
Warning: the default scope is 'global'. This signs the user out of every device they are currently signed in on, not just the current tab/session. If you only want to sign the user out of the current session (the behavior most other auth libraries default to), pass { scope: 'local' } explicitly.
const { error } = await supabase.auth.signOut()
const { error } = await supabase.auth.signOut({ scope: 'local' })
const { error } = await supabase.auth.signOut({ scope: 'others' })