Start or confirm front-channel logout.

POST

/logout

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/logout \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data confirmation_token=example \
  --data id_token_hint=example \
  --data post_logout_redirect_uri=https://example.com \
  --data state=example \
  --data logout_scope=example

A direct RP-initiated POST renders the same confirmation interaction as GET. A follow-up POST validates the form confirmation token against the short-lived confirmation cookie, then invalidates the selected session and performs configured logout propagation.

Request Body

Media type application/x-www-form-urlencoded

object

confirmation_token

string

id_token_hint

string

post_logout_redirect_uri

string format: uri

state

string

logout_scope

string

Example ^generated

confirmation_token=example&id_token_hint=example&post_logout_redirect_uri=https%3A%2F%2Fexample.com&state=example&logout_scope=example

Responses

302

Redirect after successful logout.

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}