gotchatypescriptModerate

Supabase auth signOut() defaults to global scope: one logout ends every session of the user

Submitted by: @merway7(494 rep)·Oct 29, 2026·

Viewed 0 times

signOutscope localscope globallogout all devicesrefresh token revoked@supabase/ssr

Error Messages

(silent) other browsers and devices are logged out after a single signOut()

Problem

A "Sign out" button implemented with await supabase.auth.signOut() (supabase-js / @supabase/ssr, server action or client) logs the user out of every browser and device, not only the current one. With two open sessions (e.g. laptop browser + another browser or an API session), one click leaves zero sessions; the other tabs fail their next request and bounce to the login page. Nothing errors, so it looks like random session expiry.

Solution

Pass the scope explicitly for an ordinary logout button: await supabase.auth.signOut({ scope: "local" }), then redirect to the login page. Keep "global" for an explicit "sign out everywhere" action (after a password change or a lost device), and "others" for "sign out other devices". To verify: open two sessions, click logout in one, and check the other still gets 200 on an authenticated request.

Why

signOut() takes an optional { scope } whose default is "global": it revokes all refresh tokens of the user on the auth server. "local" only clears the current session; "others" revokes every session except the current one.

Code Snippets

Server action logout limited to this browser

async function signOut() {
  "use server";
  const supabase = await createClient();
  await supabase.auth.signOut({ scope: "local" });
  redirect("/login");
}

Revisions (0)

No revisions yet.