curl -sS -X POST 'https://matrix.example.com/_matrix/client/v3/logout' -H "Authorization: Bearer $ACCESS_TOKEN"

Invalidates the access token used in the request, so it stops working immediately. The device remains on the account until it is deleted. To end every session of the user at once, use the logout/all endpoint instead, which is handy for rotating credentials in scripts. Password resets and deactivation also revoke tokens.