feat: The OIDC logout flow is supported

e2e/tests/dpop-smoke.test.ts

@@ -353,6 +353,7 @@ test.describe('DPoP smoke tests', () => {
   let accessToken: string;
   let refreshToken: string;
   let thumbprint: string;
+  let core: SDKCore;
 
   test.beforeAll(async ({ browser }) => {
     context = await browser.newContext();
@@ -398,7 +399,7 @@ test.describe('DPoP smoke tests', () => {
     let notify:
       ((result: { state?: string } | { error: Error }) => void) | undefined;
 
-    const core = new SDKCore({
+    core = new SDKCore({
       serverUrl: FA_URL,
       clientId: CLIENT_ID,
       redirectUri: REDIRECT_URI,
@@ -501,6 +502,33 @@ test.describe('DPoP smoke tests', () => {
     expect(manager.isLoggedIn).toBe(true);
   });
 
+  test('startLogout() clears DPoP state and redirects to the logout URL', async () => {
+    test.skip(!accessToken, 'No access token from previous test');
+
+    expect(core.isLoggedIn).toBe(true);
+    expect(core.getAccessToken()).toBe(accessToken);
+
+    const { assign, waitForUrl } = createAssignWaiter();
+    // @ts-ignore
+    globalThis.window.location = { assign };
+
+    core.startLogout();
+    const assignedUrl = new URL(String(await waitForUrl()));
+
+    expect(assignedUrl.origin).toBe(FA_URL);
+    expect(assignedUrl.pathname).toBe('/app/logout/');
+    expect(assignedUrl.searchParams.get('client_id')).toBe(CLIENT_ID);
+    expect(assignedUrl.searchParams.get('post_logout_redirect_uri')).toBe(
+      REDIRECT_URI,
+    );
+
+    expect(core.isLoggedIn).toBe(false);
+    expect(core.getAccessToken()).toBeNull();
+
+    const tokenStore = new DPoPTokenStore(CLIENT_ID, 'localStorage');
+    expect(tokenStore.get()).toBeNull();
+  });
+
   test('refresh token grant — issues new DPoP-bound tokens', async () => {
     test.skip(!refreshToken, 'No refresh token from previous test');
 

packages/core/src/DPoP/DPoPManager.test.ts

@@ -540,6 +540,28 @@ describe('getExpiresAt()', () => {
   });
 });
 
+describe('getAccessToken()', () => {
+  it('returns null when no tokens are stored', () => {
+    const manager = makeManager();
+    expect(manager.getAccessToken()).toBeNull();
+  });
+
+  it('returns the accessToken of the stored tokens', () => {
+    const manager = makeManager();
+    manager.setTokens(makeTokens({ accessToken: 'stored-access-token' }));
+    expect(manager.getAccessToken()).toBe('stored-access-token');
+  });
+
+  it('returns null after clear()', async () => {
+    const manager = makeManager();
+    manager.setTokens(makeTokens());
+
+    await manager.clear();
+
+    expect(manager.getAccessToken()).toBeNull();
+  });
+});
+
 describe('clear()', () => {
   it('removes the key pair from DPoPStorage', async () => {
     const manager = makeManager();

packages/core/src/DPoP/DPoPManager.ts

@@ -88,6 +88,13 @@ export class DPoPManager {
     return this.tokenStore.get()?.refreshToken ?? null;
   }
 
+  /**
+   * Returns the stored access token string, or `null` if none is stored.
+   */
+  getAccessToken(): string | null {
+    return this.tokenStore.getAccessToken();
+  }
+
   /**
    * Returns the expiration moment (ms since epoch) of the stored access
    * token, or `-1` if no tokens are stored. Mirrors the `-1` convention used

packages/core/src/SDKCore/SDKCore.test.ts

@@ -290,6 +290,40 @@ describe('SDKCore', () => {
       );
     });
 
+    it('getAccessToken() returns the stored access token when useDpop: true', () => {
+      vi.spyOn(DPoPManager.prototype, 'getOrCreateKeyPair').mockResolvedValue(
+        {} as any,
+      );
+      const core = new SDKCore(dpopConfig);
+
+      const dpopManager = (core as any).dpopManager as DPoPManager;
+      dpopManager.setTokens({
+        accessToken: 'mock-access-token',
+        refreshToken: undefined,
+        expiresAt: Date.now() + 60_000,
+        tokenType: 'DPoP',
+      });
+
+      expect(core.getAccessToken()).toBe('mock-access-token');
+    });
+
+    it('getAccessToken() returns null when logged out in DPoP mode', () => {
+      vi.spyOn(DPoPManager.prototype, 'getOrCreateKeyPair').mockResolvedValue(
+        {} as any,
+      );
+      const core = new SDKCore(dpopConfig);
+
+      expect(core.getAccessToken()).toBeNull();
+    });
+
+    it('getAccessToken() throws when useDpop: false', () => {
+      const core = new SDKCore(config); // no useDpop
+
+      expect(() => core.getAccessToken()).toThrow(
+        'getAccessToken() is only available in DPoP mode. In hosted backend mode, tokens are stored in HttpOnly cookies and are not accessible to JavaScript.',
+      );
+    });
+
     describe('handlePostRedirect() in DPoP mode', () => {
       const MOCK_PROOF = 'mock-dpop-proof-jwt';
       const MOCK_CODE = 'mock-authorization-code';

packages/core/src/SDKCore/SDKCore.ts

@@ -93,14 +93,57 @@ export class SDKCore {
     window.location.assign(this.urlHelper.getRegisterUrl(state));
   }
 
-  startLogout() {
+  /**
+   * Initiates the logout flow.
+   *
+   * In DPoP mode, this synchronously returns after starting an
+   * asynchronous flow.
+   *
+   * In hosted backend mode, the flow is synchronous.
+   */
+  startLogout(): void {
+    if (this.dpopManager) {
+      this.startDpopLogout().catch(error => {
+        console.error('FusionAuth SDK: startLogout failed', error);
+      });
+      return;
+    }
+
     window.location.assign(this.urlHelper.getLogoutUrl());
   }
 
+  /**
+   * Performs the DPoP mode logout flow, clearing the key pair, stored
+   * tokens, and in-memory nonces.
+   */
+  private async startDpopLogout(): Promise<void> {
+    try {
+      await this.dpopManager!.clear();
+    } finally {
+      window.location.assign(this.urlHelper.getLogoutUrl());
+    }
+  }
+
   manageAccount() {
     window.location.assign(this.urlHelper.getAccountManagementUrl());
   }
 
+  /**
+   * Returns the current DPoP mode access token.  In hosted backend mode, tokens
+   * are stored in HttpOnly cookies and are never accessible to JavaScript,
+   * so this method throws instead.
+   *
+   * @throws {Error} if called in hosted backend mode
+   */
+  getAccessToken(): string | null {
+    if (!this.dpopManager) {
+      throw new Error(
+        'getAccessToken() is only available in DPoP mode. In hosted backend mode, tokens are stored in HttpOnly cookies and are not accessible to JavaScript.',
+      );
+    }
+    return this.dpopManager.getAccessToken();
+  }
+
   async fetchUserInfo<T = UserInfo>() {
     const userInfoResponse = await fetch(this.urlHelper.getMeUrl(), {
       credentials: 'include',