Logout

signOut(event, { postLogoutRedirectUri }) revokes the refresh token when the provider has a revocation endpoint (best effort: the session ends whatever the provider answers), destroys the session, and redirects to the provider's end_session_endpoint with id_token_hint, client_id and post_logout_redirect_uri so the provider's own session ends too. A provider without that endpoint gets a redirect to the local target. logoutUrl(event, options) returns the URL without ending the session. The return address must be a path or a URL of your own site (anything else throws a TypeError), and it must be registered at the provider.