Signing out

Signing out at the issuerCopy Anchor Link

Signing out of your app alone leaves the person signed in at the brand, so the next sign-in goes straight through. To end the brand's session too, send them to /session/end on the issuer with:

• id_token_hint: their ID token (or client_id, your app's), which names your app
• post_logout_redirect_uri: where to bring them back, one of your app's registered post_logout_redirect_uris, matched exactly
• state, if you want it back

The brand's page always asks first. "Yes" ends the brand's session in that browser, and every grant that lives only as long as it: refresh tokens without offline_access stop working. When your app asked, the other answer signs them out of your app alone. Register post-logout URIs with Change an app; a URI your app didn't register is ignored.

Back-channel logoutCopy Anchor Link

To hear when a session your app signed in to ends, give the app a backchannel_logout_uri: https, on a public host. Synq then posts a signed logout_token to it (OpenID Connect Back-Channel Logout 1.0): a JWT signed like your ID tokens, typ logout+jwt, naming the person (sub) and, unless you turned backchannel_logout_session_required off, the session (sid). Check its signature against the issuer's keys, its iss, its aud (your client id) and its events, then end your own session for it.

Your app is told when:

• the person signs out at the issuer
• the person ends a session, or asks for their account to be deleted, through the account API
• the tenant disables the user, ends their sessions or schedules their deletion
• a password reset or a claimed email address ends every session

Synq waits 2.5 seconds at most for your answer and follows no redirect. A failure never stops the sign-out, and a session Synq ends itself is retried. Only apps registered through the management API get post-logout and back-channel URIs: an app that registered itself is never sent anywhere it chose.