Signing out

A member’s session on your site must not outlive their FINNS sign-in. Two signals tell you it ended; handle both.

Signal	Sent by	When	Identifies
POST /auth/revoke	Core	The member signs out of the FINNS app	sub, and sid if known
Back-channel logout	Keycloak	The Keycloak session ends (web sign-out, admin action, expiry)	sid, or sub

sequenceDiagram
  autonumber
  actor G as Guest
  box rgb(227,244,243) FINNS platform
    participant APP as FINNS app
    participant CORE as Core
    participant KC as Keycloak
  end
  box rgb(246,241,233) Booking engine
    participant BE as Booking backend
  end

  G->>APP: Sign out
  APP->>CORE: POST /api/v1/app/logout
  Note over CORE: nowrap:Void this session's unused handoff codes
  CORE-)BE: POST /auth/revoke {sub, sid}<br/>Bearer <revoke token>
  Note over BE: nowrap:Delete sessions for sub and sid.<br/>Remember sub (10 h) and sid (1 h)
  BE-->>CORE: 200 {}
  opt Keycloak session ends
    KC-)BE: POST /auth/backchannel-logout<br/>logout_token (signed JWT)
    Note over BE: nowrap:Verify, block jti replay,<br/>delete sessions by sid (or sub)
    BE-->>KC: 200
  end

POST /auth/revoke (from core)

POST /auth/revoke HTTP/1.1
Authorization: Bearer <revoke token>
Content-Type: application/json

{ "sub": "6f1c2a…", "sid": "a9d0…" }

• Host it at the root of your origin. Check the bearer in constant time; it differs from your API token.
• sub and sid are strings of 1–128 characters; at least one is present. Reject anything else with 400.
• Delete every session for that sub and that sid, then answer exactly 200. Core retries once on anything else.
• Remember the sign-out for a while (the reference keeps sub 10 hours, sid 1 hour), so an in-flight handoff or SSO response that started before the sign-out can’t create a new session after it.

Back-channel logout (from Keycloak)

Register the URL on your Keycloak client with “backchannel logout session required” on. Keycloak posts a form-encoded logout_token. Verify it fully:

Check	Value
Signature	Realm’s JWKS; RS256, PS256 or ES256
iss, aud	The FINNS realm; your client id
Age	iat present, at most 5 minutes old (30 s clock skew)
events	Contains http://schemas.openid.net/event/backchannel-logout
nonce	Must be absent
jti	Present, and never seen before (store recent ones)

Then delete sessions by sid, or by sub if there’s no sid.

Signing out of your site only

A “Sign out” button on your site should end your session only, and must not end the member’s Keycloak session: that would sign them out of the FINNS app on the web too. Remember the choice for a while so silent sign-in doesn’t immediately sign them back in.