Logout

End the WorkOS session and redirect to frontend login.

OIDC provider spec D-53: dashboard sign-out also revokes EVERY SSO session record for this user (keyed on user_id — a NULL workos_session_id must not make records unfindable) and back-channel-terminates the upstream WorkOS sessions those records held. Revoking our record alone is not sufficient: /oidc/authorize treats a revoked record as "no session" and bounces to WorkOS, whose live session would near-silently re-login the previous user.

The get_logout_url redirect hop is deliberately KEPT alongside the back-channel kill until the Phase-1 human verification confirms revoke_session alone stops AuthKit silent re-auth (§14); only then may the hop be dropped. The SSO cookie is cleared on every response as belt over the record revoke (it was never authoritative, but clearing keeps this browser signed out even if the DB revoke failed).