Register a backchannel_logout_uri on your relying party client registration; this must be an HTTPS URL that Cognito, Okta, or another OP can reach directly from its backend.
Advertise back-channel logout support in your RP's metadata and confirm the OP supports it by checking the backchannel_logout_supported and backchannel_logout_session_supported claims in the OP's discovery document.
When your endpoint receives a POST from the OP, extract the logout_token from the request body (application/x-www-form-urlencoded), verify its signature using the OP's JWKS, and validate the required claims: iss, aud, iat, jti, and the events claim containing http://schemas.openid.net/event/backchannel-logout.
Confirm the logout_token does not contain a nonce claim (its presence makes the token invalid per the spec) and that jti has not been seen before within the token's validity window.
Using the sub or sid claim from the logout token, invalidate all sessions for that user or that specific session in your application.
Return HTTP 200 (or 204) synchronously once session invalidation is complete; return 400 if the token is invalid; the OP may retry on non-2xx responses.
Known gotchas
The logout_token is NOT an ID token; while it shares a similar structure, validating it as an ID token will fail because its events claim and the absence of nonce are specific to logout tokens.
Back-channel logout requires your endpoint to be reachable from the OP's server infrastructure, not just the user's browser; endpoints behind firewalls or on localhost will not work without a tunnel or public deployment.
If you store sessions in a distributed cache, invalidation must propagate to all nodes before you return 200; a race condition between the OP retrying and a node serving a stale session can allow access after logout.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp