Type Alias SignOut

Whether to end the session with a top-level navigation to the auth server's /logout (RP-initiated logout). Defaults to true for the global scope in a browser.

This is required to clear the auth server's SSO cookie: it lives on the auth domain, so a cross-origin fetch from your app can neither send nor clear it. Without the navigation the SSO session survives and the next /authorize silently re-logs the previous user, ignoring the requested connection.

Set to false to keep the legacy behaviour (clear local storage + a best-effort cross-origin fetch to /logout) — e.g. when your app and the auth server share a site, or you drive the navigation yourself with FaableAuthClient.getLogoutUrl. Ignored for the local/others scopes and outside the browser.

Where the auth server should send the browser back to after logging out, mapped to the OIDC post_logout_redirect_uri. Must be registered as a logout URL on the client or the server responds 400. Only used on the redirect path.

Which sessions to log out.

• 'app' (default) — this app only: its refresh token is revoked at the auth server and its storage cleared. The tenant's SSO session stays, so the user's other apps on the tenant keep theirs, and the next sign-in here comes back without asking
• 'global' — this browser's session at the auth server (every refresh token it issued is refused from then on, in every app of the tenant) plus this client's storage
• 'local' — only this client's storage; the server is not told
• 'others' — every other session of the user except this one (POST /me/sessions/revoke-others); the local session stays and no SIGNED_OUT event is fired