To properly implement logout, you need to handle both sessions separately:

Recommended Logout Flow

1. User initiates logout in your application
2. Your backend revokes the refresh token using the Revoke Refresh Tokens API:

   DELETE /api/jwt/refresh/{refreshTokenId}
   

   Or revoke by user and application:

   DELETE /api/jwt/refresh?userId={userId}&applicationId={applicationId}
   

3. Destroy your local application session (clear tokens, cookies, etc.)
4. Redirect to /oauth2/logout with id_token_hint to clear the SSO session

Why This Approach?

Revoking the refresh token from your application (step 2) is better than relying on the logout URL callback because:

• You have direct access to the user's session data
• You know exactly which refresh token to revoke
• You can handle errors gracefully
• The flow is more deterministic

The /oauth2/logout endpoint can call a logout URL configured in your FusionAuth OAuth application settings, but handling revocation proactively in your app provides better control.

Important Note About JWTs

Since JWTs (access tokens) are stateless, they cannot be immediately revoked by FusionAuth. If you need to invalidate JWTs before their natural expiration, you'll need to implement your own revocation strategy, such as maintaining a token denylist in your application.

Related Documentation

• OAuth Logout API - Details on the /oauth2/logout endpoint
• Revoke Refresh Tokens API - How to revoke refresh tokens programmatically
• Logout and Session Management - Comprehensive guide on logout strategies and session types
• Revoking JWTs - Strategies for JWT revocation
• JWT Refresh Token Revoke Event - Webhook event when refresh tokens are revoked