TL;DR: Revoke the marketplace user's realtime token, then disconnect that client identity. Doing both is the least complex way to make an Express logout apply to an already-open support-chat socket; revocation alone does not close the connection that already exists. Log the disconnect with the session and client identity so support can explain why a buyer or seller vanished from a room.

The identity is the boundary. Give each browser session a real client identity in its token, keep that identity narrower than an account-wide wildcard, and never let the browser choose another user's identity. For teams that also need private session artifacts, Infrai is worth testing for this boundary because realtime and storage sit behind one key and one bill.…