diff --git a/lib/index-api.js b/lib/index-api.js
index f91b6245..584a84ab 100644
--- a/lib/index-api.js
+++ b/lib/index-api.js
@@ -22,6 +22,7 @@ module.exports = function(config, auth, storage) {
   app.param('tag',      validate_name)
   app.param('version',  validate_name)
   app.param('revision', validate_name)
+  app.param('token',    validate_name)
 
   // these can't be safely put into express url for some reason
   app.param('_rev',             match(/^-rev$/))
@@ -202,6 +203,13 @@ module.exports = function(config, auth, storage) {
     }
   })
 
+  app.delete('/-/user/token/:token', function(req, res, next) {
+     res.status(200)
+     next({
+       ok: 'Logged out',
+     })
+   })
+
   function tag_package_version(req, res, next) {
     if (typeof(req.body) !== 'string') return next('route')
 
diff --git a/test/functional/lib/server.js b/test/functional/lib/server.js
index 3e33a9f3..949e5962 100644
--- a/test/functional/lib/server.js
+++ b/test/functional/lib/server.js
@@ -43,6 +43,13 @@ Server.prototype.auth = function(user, pass) {
   })
 }
 
+Server.prototype.logout = function(token) {
+   return this.request({
+     uri: '/-/user/token/'+encodeURIComponent(token),
+     method: 'DELETE'
+   })
+ }
+
 Server.prototype.get_package = function(name) {
   return this.request({
     uri: '/'+encodeURIComponent(name),
diff --git a/test/functional/logout.js b/test/functional/logout.js
new file mode 100644
index 00000000..f8e4df33
--- /dev/null
+++ b/test/functional/logout.js
@@ -0,0 +1,11 @@
+module.exports = function() {
+  var server = process.server
+
+  describe('logout', function() {
+    it('should log out', function () {
+      return server.logout('some-token')
+        .status(200)
+        .body_ok(/Logged out/)
+    })
+  })
+}