Problem
Hermes Workspace with HERMES_PASSWORD enabled has no way to sign out. The only auth route is POST /api/auth (login); there is no logout endpoint and no UI affordance. Users must manually clear the claude-auth cookie or wait for the 30-day TTL to expire.
This matters for shared/borrowed devices and for deployments behind an upstream IdP (e.g. OIDC) where the workspace password is a second factor — after finishing a session there is no clean way to end it.
Expected
- A logout endpoint (e.g.
DELETE /api/auth) that revokes the session token and clears the cookie.
- A Sign out affordance in the UI (desktop sidebar user menu + mobile drawer).
Related
PR #789 implements this.
Problem
Hermes Workspace with
HERMES_PASSWORDenabled has no way to sign out. The only auth route isPOST /api/auth(login); there is no logout endpoint and no UI affordance. Users must manually clear theclaude-authcookie or wait for the 30-day TTL to expire.This matters for shared/borrowed devices and for deployments behind an upstream IdP (e.g. OIDC) where the workspace password is a second factor — after finishing a session there is no clean way to end it.
Expected
DELETE /api/auth) that revokes the session token and clears the cookie.Related
PR #789 implements this.