OpenID Connect (OIDC) and OAuth 2.0 refresh and access tokens become inactive after a user selects the End all sessions button from the dashboard because Okta triggers an API endpoint that revokes all active sessions and tokens. This behavior is not configurable, but workarounds include educating users not to use the option or using separate accounts for API request authorization. The observable issue occurs when tokens are revoked prematurely, even though they have not expired. The End all sessions (or Sign me out of all other devices for Okta Classic Engine) button appears on the end-user dashboard, as shown in the following images:

Okta Identity Engine

Okta Classic Engine

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Session Management
• End All Sessions
• OAuth 2.0
• OpenID Connect (OIDC)

When a user selects the End all sessions function on the dashboard, Okta triggers the /idp/myaccount/sessions API endpoint. As documented in the Sessions API documentation, the designed function of this endpoint is to delete all user sessions, revoke all active identity provider (IdP) sessions, and revoke all OIDC and OAuth 2.0 refresh and access tokens issued to the user. This behavior is not configurable.

How are premature token revocations mitigated?

This behavior is not currently configurable. Submit an idea as a feature request for consideration in the Okta Product Roadmap by reviewing How to Submit a Feature or Enhancement Request using Okta Ideas.

Mitigate this issue by implementing the following workarounds.

• Educate users to avoid selecting the End all sessions button unless they suspect their account is compromised.
• Use separate user accounts for API request authorization to isolate tokens from user dashboard sessions.

Related References

• How to Submit a Feature or Enhancement Request using Okta Ideas
• Manage account settings