Sessions and logout
Three state owners are involved:
| State | Owner | Typical termination |
|---|---|---|
| Product application session | Product BFF | Delete the product session cookie |
| OAuth refresh grant | Identity tenant | Revoke the refresh token |
| Browser SSO session | Identity issuer | Same-origin Identity logout |
The Identity browser-session logout endpoint is /identity/session/logout. It terminates the issuer’s SSO session; it does not delete every product application’s session. Product logout should clear its own session and revoke the refresh token it owns. Global cross-product logout is a separate orchestration concern.