OIDC logout returns 404 for GLOBAL apps

Symptom#

A GLOBAL-scoped application tries to log a user out via something like:

scdoc

1	`https://scaikey.scailabs.ai/oidc/logout?post_logout_redirect_uri=...&client_id=...`

The browser sees a 404. The user stays signed in.

Cause#

There is no /oidc/logout route in ScaiKey. The URL was a guess; nothing serves it.

Real OIDC logout (RP-initiated end_session) endpoints in ScaiKey are:

Tenant-scoped: /api/v1/auth/tenants/{slug}/oauth/logout
Platform (for GLOBAL apps): /api/v1/platform/oauth/logout

A GLOBAL application doesn't have a tenant slug to put in the URL, which is why the tenant variant isn't usable — that's the right intuition. The fix is to use the platform variant, which resolves the user's tenant via the SSO session cookie instead of from the URL.

Fix#

Send users to:

scdoc

1	`$SCAIKEY/api/v1/platform/oauth/logout?post_logout_redirect_uri=https%3A%2F%2Fyourapp.example%2Flogin&client_id=<your client_id>`

Query parameters:

Parameter	Required	Notes
`post_logout_redirect_uri`	recommended	Where to send the user after logout. Validated — must match a registered `logout_uri` exactly, or share an origin (scheme + host + port) with a registered `redirect_uri`. Unaccepted values are ignored and the user lands on the ScaiKey signed-out page.
`id_token_hint`	strongly recommended	The ID token from login. Identifies the session (`sid`) and the client (`aud`), which is what lets us revoke your application's refresh tokens when the browser arrives without its SSO cookie. Send it even if expired — we verify the signature, not the expiry.
`state`	optional	Echoed back in the redirect for CSRF
`client_id`	optional	Not informational: it identifies which application's registered URIs to validate `post_logout_redirect_uri` against, when `id_token_hint` is absent.

The endpoint:

Identifies the session — from the SSO cookie, or from sid in a signature-verified id_token_hint.
Terminates the session (sets terminated_at, terminated_reason=user_logout).
Revokes refresh tokens bound to that session, plus those of the client identified by id_token_hint.
Clears the SSO cookie.
Redirects to post_logout_redirect_uri if it passes validation, otherwise to the default ScaiKey "signed out" page.

Access tokens are not revoked — they are self-contained JWTs valid until exp. Keep their lifetime short, or introspect at resource servers if you need immediate effect.

Note that the endpoint must be reached by a browser redirect. A server-side call carries no SSO cookie and, without id_token_hint, ends nothing.

Discovery#

The platform .well-known/openid-configuration document includes end_session_endpoint pointing at the platform logout URL — modern OIDC libraries read this automatically when configured against the platform discovery URL. If your OIDC library is reading discovery, you shouldn't need to hardcode anything.

Auth UI behavior#

If you hit $SCAIKEY/auth/logout?post_logout_redirect_uri=... directly (the user-facing logout page rather than the OIDC endpoint), the page clears local browser state and then bounces to post_logout_redirect_uri. This works for GLOBAL apps too — it's a fine fallback if you want to control the visible "signing out…" message before redirect. Note it's a frontend page, not an OIDC end_session endpoint, so it doesn't appear in discovery.