diff --git a/lib/index-api.js b/lib/index-api.js
index f91b6245..a1496ad6 100644
--- a/lib/index-api.js
+++ b/lib/index-api.js
@@ -22,6 +22,7 @@ module.exports = function(config, auth, storage) {
   app.param('tag',      validate_name)
   app.param('version',  validate_name)
   app.param('revision', validate_name)
+  app.param('token',    validate_name)
 
   // these can't be safely put into express url for some reason
   app.param('_rev',             match(/^-rev$/))
@@ -202,6 +203,13 @@ module.exports = function(config, auth, storage) {
     }
   })
 
+  app.delete('/-/user/token/:token', function(req, res, next) {
+    res.status(200)
+    next({
+      ok: 'Logged out',
+    })
+  })
+
   function tag_package_version(req, res, next) {
     if (typeof(req.body) !== 'string') return next('route')
 
diff --git a/test/functional/index.js b/test/functional/index.js
index c424eaa2..201a3d41 100644
--- a/test/functional/index.js
+++ b/test/functional/index.js
@@ -59,6 +59,7 @@ describe('Func', function() {
   require('./scoped')()
   require('./security')()
   require('./adduser')()
+  require('./logout')()
   require('./addtag')()
   require('./plugins')()
 
diff --git a/test/functional/lib/server.js b/test/functional/lib/server.js
index 3e33a9f3..e2b733cf 100644
--- a/test/functional/lib/server.js
+++ b/test/functional/lib/server.js
@@ -43,6 +43,13 @@ Server.prototype.auth = function(user, pass) {
   })
 }
 
+Server.prototype.logout = function(token) {
+  return this.request({
+    uri: '/-/user/token/'+encodeURIComponent(token),
+    method: 'DELETE'
+  })
+}
+
 Server.prototype.get_package = function(name) {
   return this.request({
     uri: '/'+encodeURIComponent(name),
diff --git a/test/functional/logout.js b/test/functional/logout.js
new file mode 100644
index 00000000..3729e70c
--- /dev/null
+++ b/test/functional/logout.js
@@ -0,0 +1,11 @@
+module.exports = function() {
+  var server = process.server
+
+  describe('logout', function() {
+    it('should log out', function () {
+      return server.logout('some-token')
+               .status(200)
+               .body_ok(/Logged out/)
+    })
+  })
+}