diff --git a/46.md b/46.md
index 8bad3db8..89a80efa 100644
--- a/46.md
+++ b/46.md
@@ -106,6 +106,7 @@ Each of the following are methods that the _client_ sends to the _remote-signer_
 | `nip44_encrypt`          | `[<third_party_pubkey>, <plaintext_to_encrypt>]`                              | `<nip44_ciphertext>`                                                   |
 | `nip44_decrypt`          | `[<third_party_pubkey>, <nip44_ciphertext_to_decrypt>]`                       | `<plaintext>`                                                          |
 | `switch_relays`          | `[]`                                                                          | `["<relay-url>", "<relay-url>", ...]` OR `null`                        |
+| `logout`                 | `[]`                                                                          | `"ack"`                                                                |
 
 ### Requested permissions
 
@@ -117,6 +118,12 @@ At all times, the _remote-signer_ should be in control of what relays are being
 
 Therefore, compliant clients should send a `switch_relays` request immediately upon establishing a connection (always, or at reasonable intervals). Upon receiving such requests, the _remote-signer_ should reply with its updated list of relays, or `null` if there is nothing to be changed. Immediately upon receiving an updated relay list, the _client_ should update its local state and send further requests on the new relays. The `remote-signer` should then be free to disconnect from the previous relays if that is desired.
 
+### Ending a session
+
+When the _user_ logs out of the _client_, the _client_ MAY send a `logout` request to inform the _remote-signer_ that the session is no longer needed. Upon receiving such a request, the _remote-signer_ SHOULD remove the session associated with the requesting `client-pubkey` and reject any further requests from it (a new `connect` would be required to re-establish a session). The _remote-signer_ should reply with `"ack"` before removing the session.
+
+The `logout` request is a courtesy hint and is not a security boundary: the _remote-signer_ MUST NOT rely on it being sent, and the _client_ MUST still delete its locally stored `client-keypair` on logout regardless of whether the request was acknowledged.
+
 ## Response Events `kind:24133`
 
 ```json