Ends a user’s session, following the OpenID Connect RP-Initiated Logout pattern.

Use this endpoint when your application signs a user out and, optionally, returns them to your site afterwards. You can call it with either GET (for example, by redirecting the user’s browser) or POST. Identify the user by passing the ID token you previously received as id_token_hint.
This endpoint doesn’t require an access token, so it works even when the access token has expired. To return the user to your application after logout, pass post_logout_redirect_uri, which must exactly match one of the post-logout redirect URIs registered for your client. By default, only the current session’s refresh tokens are revoked.

Add logoutAll=true as a query parameter to end all of the user’s sessions across devices. Include logoutAll in the URL query string, because it is not read from a POST body. If no id_token_hint is supplied, the request succeeds but no sessions are ended.