Here's my suggestion:
localOnly-> delete any local copies of sessionToken or apiKey
NOT localOnly -> (1) if client has sessionToken, then call "DELETE /session"; (2) do the localOnly part
there should be a separate command "invalidateAPIKey" that calls DELETE /secretKey