Sign-out and revocation

Three levels

Sign out of your site. Yours to handle: drop your own session cookie. auth.my knows nothing about it, and pressing "Sign in" lets the user straight back — their auth.my session is still alive.

Sign out of auth.my. The session on our side ends. The next sign-in requires an emailed code, a passkey or a social provider.

Revoke a site's access. The user does this in their own console, under Connected sites. Your site stops receiving tokens entirely.

Signing out of auth.my

https://auth.my/session/end
  ?id_token_hint=YOUR_ID_TOKEN
  &post_logout_redirect_uri=https%3A%2F%2Fexample.com%2F

post_logout_redirect_uri must also be registered in the client settings — otherwise sign-out ends on our page rather than yours.

id_token_hint is not a formality: without it we do not know who is signing out and have to ask the user to confirm.

Revoking a token

curl -u "CLIENT_ID:CLIENT_SECRET" https://auth.my/token/revocation \
  -d token=TOKEN

Kills a single token. Useful when you want to stop your own background access without involving the user.

When access disappears without your involvement

• the user pressed "Block site" in their console;
• refresh token theft was detected and the chain was revoked;
• the auth.my session ended and you did not request offline_access;
• an organization administrator removed the member.

In every case you see invalid_grant on refresh. The response is the same: send the user to sign in again.

You can also check a token explicitly:

curl -u "CLIENT_ID:CLIENT_SECRET" https://auth.my/token/introspection \
  -d token=TOKEN

{ "active": false }