Implementing logout (Scalekit FSA)

Goal

Implement a single /logout endpoint that:

• Clears the application session layer (your cookies/tokens).
• Invalidates the Scalekit session layer by redirecting the browser to Scalekit’s OIDC logout endpoint.
• Returns the user to a safe, allowlisted post-logout redirect URL.

Key constraints (must follow)

• The Scalekit logout call MUST be a browser redirect (top-level navigation), not a fetch/XHR from frontend and not a server-to-server API call.
• The ID token (often idToken) MUST be read BEFORE clearing cookies, because it is used as id_token_hint.
• The post_logout_redirect_uri MUST be allowlisted in Scalekit Dashboard (Post Logout URLs).

Inputs to collect from the user/project

Ask for (or infer from the codebase):

• Tech stack: Express/Fastify/Next.js (Node), Flask/Django (Python), Gin/Fiber (Go), Spring Boot (Java), etc.
• Where tokens are stored: cookie names (default examples: accessToken, refreshToken, idToken) and cookie attributes (Path, Domain, SameSite).
• The post-logout landing URL (example: http://localhost:3000/login or your production login page).
• Scalekit configuration: base URL / environment, and whether the project uses a Scalekit SDK helper like getLogoutUrl(...).