---
title: "Unlink push from the account at sign-out · Agent Wranglers"
url: https://agentwranglers.se/playbook/notifications/push-notifications/unlink-push-on-sign-out
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Unlink push from the account at sign-out

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Push notifications](https://agentwranglers.se/playbook/notifications/push-notifications.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Required
- Chapter: [Push notifications](https://agentwranglers.se/playbook/notifications/push-notifications)
- Rule: When a session ends, delete the push subscriptions and device tokens it registered. The next person on that device never gets the last person's notifications.
- Risk: Data leaked or lost
- Applies when: The project has user accounts.
- How: Store the session ID next to each subscription or token row. On sign-out, delete those rows on the server, and in the browser call `PushSubscription.unsubscribe()`. Do the same when another device or an admin ends the session, as [Let people sign out of one device or all of them](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions) describes. On the next sign-in, the app subscribes again for the new account. A shared tablet or a sold phone otherwise keeps showing order and message alerts for an account nobody is signed in to.
- Check: Sign in as user A in a test browser and turn on push. Sign out, sign in as user B, and send a notification to A. The push service gets no request for that endpoint, and no row links A to it.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
export async function signOut() {
  const registration = await navigator.serviceWorker.ready;
  const subscription = await registration.pushManager.getSubscription();
  await fetch('/session', { method: 'DELETE' }); // the server deletes push rows for this session
  await subscription?.unsubscribe();
  location.assign('/signed-out');
}
```

### Python example

```python
@app.delete("/session")
@login_required
def sign_out():
    session_id = current_session.id
    db.push_subscriptions.delete_where(session_id=session_id)
    db.device_tokens.delete_where(session_id=session_id)
    db.sessions.delete(session_id)
    return "", 204
```

## Sources

- [W3C Push API, PushSubscription unsubscribe method](https://www.w3.org/TR/push-api/#dom-pushsubscription-unsubscribe)

## Related rules

- [Let people sign out of one device or all of them](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/revoke-sessions) in Accounts
- [Let organisation owners sign a member out](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/owner-ends-sessions) in Accounts

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/notifications/push-notifications/unlink-push-on-sign-out">Agent Wranglers notifications playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Show a notification for every push](https://agentwranglers.se/playbook/notifications/push-notifications/visible-push-only)
- Next: [Accept push endpoints only from known push services](https://agentwranglers.se/playbook/notifications/push-notifications/push-endpoint-allow-list)
- [Push notifications](https://agentwranglers.se/playbook/notifications/push-notifications)