Sign out
GET /oauth/end_session — OpenID Connect RP-initiated logout that signs the browser out of Traummail.
GET /oauth/end_sessionSigning a user out of your app does not sign them out of Traummail. If your app offers "sign out everywhere", send the browser here afterwards. Traummail signs every account on that browser out, keeps them listed as signed out in the account chooser, and sends the browser back to you.
Query parameters
| Parameter | Required | Description |
|---|---|---|
client_id | with post_logout_redirect_uri | Your application's id. |
post_logout_redirect_uri | no | Where to return afterwards. Must be exactly the origin root (https://app.example.com/) of one of your registered redirect URIs. Without it the browser lands on Traummail's sign-in page. |
state | no | Echoed back on the redirect. |
id_token_hint | recommended | An id_token Traummail issued to your app for a user signed in on this browser. Expired tokens are accepted: the hint only identifies the user. |
With a matching id_token_hint the browser is signed out immediately. Without
one, Traummail asks the user to confirm first, so other sites cannot sign people
out silently. An unregistered post_logout_redirect_uri is refused with an error
page instead of a redirect.
Example
GET /oauth/end_session?client_id=app_01H...
&post_logout_redirect_uri=https%3A%2F%2Fapp.example.com%2F
&id_token_hint=eyJhbGciOiJFZERTQSIs...
&state=xyz123https://app.example.com/?state=xyz123To let the user pick an account the next time they sign in, send
prompt=select_account on your
next authorize request.