Signing out

When a member signs out of the app, core calls your backend so their widget sessions end too.

sequenceDiagram
  autonumber
  actor M as Member
  box rgb(227,244,243) FINNS platform
    participant APP as FINNS app
    participant CORE as Core
  end
  box rgb(246,241,233) Sota Platforms
    participant BE as Your backend
    participant W as Your widget page
  end

  M->>APP: Sign out
  APP->>CORE: POST /api/v1/app/logout
  Note over CORE: nowrap:Void unused launch codes of this session
  CORE-)BE: POST /auth/revoke {extId, signedOutAt}<br/>Bearer <revoke token>
  Note over BE: nowrap:Delete the member's sessions.<br/>Remember signedOutAt (keep the latest)
  BE-->>CORE: 200
  APP->>W: Discard the page, clear web view storage
  APP->>BE: POST /api/v1/launch {slots} (guest)
  Note over BE: nowrap:A later launch whose code has<br/>issuedAt ≤ signedOutAt is refused

POST /auth/revoke

POST /auth/revoke HTTP/1.1
Authorization: Bearer <revoke token>
Content-Type: application/json

{ "extId": "0b6c3f6e-…", "signedOutAt": "2026-10-13T02:30:00Z" }

• At the root of your origin; check the bearer in constant time.
• extId: lowercase UUID. signedOutAt: an ISO 8601 UTC instant on core’s clock, like issuedAt; reject values more than a minute ahead of yours.
• Delete every session of that member, store max(previous, signedOutAt), and answer exactly 200. Core retries once otherwise.
• Refuse any later launch whose redeemed issuedAt is at or before the stored signedOutAt. Both times come from core, so clock drift between you and core doesn’t matter.

When no sign-out arrives

If the member’s app session simply times out, there is nothing to report. Your session still ends on its own at notAfter, which core set to the app token’s expiry.