You might also want to add an option for users to add a signout forward url.
For example keycloak users could point that to the keycloak signout to end the keycloak session.

@Ornias1993 that makes sense - the only problem is that once the cookie is removed, the user wouldn't be able to access keycloak (if it's behind tfa) - can you set a redirect in keycloak? (If so, the user could go there first, then keycloak could send them to /_oauth/signout?

I think "logout" is the better phrase for this as it more narrowly fits what this does (and you normally say OAuth2 "login", or visit the "login" page)