Discovery
Read end_session_endpoint from OIDC discovery instead of hard-coding it.
GET https://id.memolab.me/.well-known/openid-configuration "end_session_endpoint": "https://id.memolab.me/oauth/logout"
MemoID supports an OIDC end-session endpoint for applications that need to end the MemoID browser session and return the user to a pre-registered post-logout URI.
The app and MemoID each own a session. A safe return destination completes the journey.
End its own local session.
End this browser’s MemoID session.
Check state before showing the result.
Read end_session_endpoint from OIDC discovery instead of hard-coding it.
GET https://id.memolab.me/.well-known/openid-configuration "end_session_endpoint": "https://id.memolab.me/oauth/logout"
Include id_token_hint when available, a registered post_logout_redirect_uri, and an unpredictable state value. client_id may be supplied explicitly and must match the token audience when both are present.
https://id.memolab.me/oauth/logout? id_token_hint=ID_TOKEN &client_id=YOUR_CLIENT_ID &post_logout_redirect_uri=https%3A%2F%2Fapp.example.com%2Flogged-out &state=RANDOM_STATE
Ending the MemoID browser session does not automatically revoke every OAuth grant issued to every application. Revoke refresh/access tokens separately when your security policy requires it, and let users revoke application consent from Connected apps.
POST https://id.memolab.me/oauth/revoke Content-Type: application/x-www-form-urlencoded token=REFRESH_OR_ACCESS_TOKEN &token_type_hint=refresh_token
Keep the ID token and OAuth credentials server-side. Generate and store a state value in your own secure session before redirecting the browser.
export async function POST() {
const session = await getAppSession();
const state = crypto.randomUUID();
await destroyLocalSession({ pendingLogoutState: state });
const url = new URL("https://id.memolab.me/oauth/logout");
url.searchParams.set("id_token_hint", session.idToken);
url.searchParams.set("client_id", process.env.MEMOID_CLIENT_ID!);
url.searchParams.set("post_logout_redirect_uri",
"https://app.example.com/auth/memoid/logged-out");
url.searchParams.set("state", state);
return Response.redirect(url, 303);
}