# Single Logout — BrandApp Playground

> OIDC back-channel logout receiver and RP-initiated logout, verified with zero-dependency Web Crypto Ed25519.

- Canonical page: https://brandapp-playground.vercel.app/logout
- Markdown: https://brandapp-playground.vercel.app/logout.md
- SDK module: `@reopt-ai/brandapp-sdk/logout`

## Two directions

**Back-channel logout (receive).** Reopt notifies your server when a Reopt session is
revoked. `createBackchannelLogoutHandler()` verifies the logout token and ends the
matching local sessions. The demo drives the real `/api/auth/backchannel-logout` receiver
end to end, minting signed logout tokens through the dev IdP.

**RP-initiated logout (trigger).** When a user logs out of your app, send them through
Reopt's `end_session_endpoint` with `buildEndSessionUrl()`.

## Verification

Signature checking uses Web Crypto Ed25519 — no extra dependency. SDK 3.3 hardening adds
a retryable 503 (versus a terminal 400), throttled JWKS refetching, and a faithful dev
OIDC mock with `dev.mintLogoutToken`, which is what makes this demo runnable offline.

## Related

- [Authentication](https://brandapp-playground.vercel.app/auth.md)
- [Verify session](https://brandapp-playground.vercel.app/auth/session.md)

---

Index of every document: https://brandapp-playground.vercel.app/llms.txt
Single-file copy: https://brandapp-playground.vercel.app/llms-full.txt
HTTP API description: https://brandapp-playground.vercel.app/openapi.json