So i implemented the oauth2/logout call and that does appear to revoke the token.

what i'm facing now is in the flow after logout when i invoke the auth2 login page again like so

https://api.medplum.com/oauth2/authorize?response_type=code&client_id=6415a7d1-5f29-4942-8931-261fce19d62a&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcallback.html&scope=openid

it doesn't open the login page but redirects with the same code

&state=undefined

exchanging that for token fails {"error":"invalid_grant","error_description":"Token revoked"}

clearing the api.medplum.com cookies before calling the auth2/authorize endpoint allows relogin.

the cookie name looks like

medplum-xxx-xxx

if i know the name i can set the expiration on it i suppose.

Any thoughts @cody or @rahul1 ^

you can use the /oauth2/logout endpoint to revoke the current access token and clear the active cookie

or you can use the /auth/revoke endpoint to revoke an active access token for the same user

hm... with regards to the token exchange ..... let me look into that

it does appear that it's trying to use an existing session that may have been revoked

oh it is the same every time what is that identifier hmm

ok it's the client id...think i can make that work