What
When you sign out of a gateway (a login/authentication server Claude Code connects through), Claude Code now tries to revoke both your session token and, if present, your identity provider's refresh token directly on the gateway. It finds the right endpoint to call by looking up the gateway's .well-known/oauth-authorization-server metadata. If that lookup or the revocation call fails, Claude Code logs the failure and falls back to simply ending the session on your local machine.
Why
Previously, signing out only cleared credentials locally, so a stolen or leaked token could potentially still be used elsewhere. Actively revoking the tokens on the server closes that gap when the gateway supports it.