Sign out of an app
RP-initiated logout. With id_token_hint the tokens of that login end; the browser goes back only to an address the app registered exactly.
/oidc/logout- Access
- Public access
- Client
- Local or server client
Parameters#
| Name | Location | Meaning |
|---|---|---|
id_token_hint | Query | An ID token of this provider for the app, expired or not. |
post_logout_redirect_uri | Query | One the app registered. |
state | Query | Returned as is. |
client_id | Query | Without id_token_hint, names the app. |
Request examples#
curl -fsS 'https://veil.rip/oidc/logout'Response#
A redirect to post_logout_redirect_uri with state, or a page that says the app's session ended.
Response headers#
| Header | Value | Meaning |
|---|---|---|
Cache-Control | no-store | Never cached. |
Usage notes#
- Veil keeps no session to end: a login is a signature. Logout ends the tokens.
Errors#
The OAuth callback renders an HTML return page, including when it fails. The codes below describe the failure shown on that page. Response and error guide
Shared request errors
| HTTP | Code | Meaning and next step |
|---|---|---|
| 429 | rate_limited | An anonymous, signed-request or API-key allowance was exceeded. Wait at least |
| 500 | internal_error | An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation. |
| 503 | busy | The application has reached a temporary concurrency or database limit. Wait |