Logout about oauth2-client

[ramsey]

I don't believe OAuth itself defines any kind of logout functionality, which is why oauth2-client doesn't provide any logout mechanisms. Tokens either expire or they don't. If they do expire, OAuth provides a mechanism to refresh them, but not all providers implement token refresh.

If OAuth did define a logout, it would probably involve some manner of making a request to immediately invalidate the token so that it can't be reused on subsequent requests. Many services already provide this kind of functionality, but the user would need to log in to their account at the provider to revoke the tokens issued to other services. Most services (I've seen) do not provide token revocation through their APIs.