When the user is on the external app, they click a log-in button and get routed through Discourse’s SSO provider flow, and back to the external app. That external app can store a session with the user’s data. When the user logs out of Discourse, the webhook can delete the external app’s session. I’m not certain, but I think the webhook header is X-Discourse-Event: user_logged_out.
Edit: logging out from the external site is done with the Discourse API.
Instead of asking Discourse whether a user is logged in, you can ask the external app. In my case it’s just for things like removing the log-in button in the external site.
I can double check my code later. I haven’t looked at it in a while, but I think it did something like that.