Okta 400 Bad Request Error Occurs Due to Unregistered Logout Redirect URI
Last Updated:
Overview
An Okta 400 Bad Request error occurs during logout when the redirect URI used in the authorization request is not registered in the OpenID Connect (OIDC) client application. Resolve this issue by adding the exact redirect URI to the allowed Logout redirect URIs in the Okta Admin Console. When attempting to log out using the v1/logout endpoint, Okta generates the following error:
400 Bad Request: The "post_logout_redirect_uri" parameter must be a Logout redirect URI in the client app settings.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC) Applications
- Logout Endpoint (
/v1/logout)
Cause
The value of the <redirect_uri> used in the logout request is not registered in the OpenID Connect client application as an allowed Logout redirect URI.
Solution
How is the missing Logout redirect URI added to the OpenID Connect application?
Add the missing redirect URI to the OpenID Connect application settings in the Okta Admin Console to ensure it matches the URI included in the logout request.
- Navigate to Applications in the Okta Admin Console and select the OpenID Connect application.
- Select the General tab and click Edit.
- Add the missing URI to the Logout redirect URIs field.
- Click Save.
NOTE: The Logout redirect URIs provided in the Okta Admin Console must be an exact, case-sensitive match, including trailing slashes, with the URI included in the logout request.
Review the following example of a v1/logout request and the corresponding application configuration to verify the correct setup.
https://<domain.okta.com>/oauth2/v1/logout?id_token_hint=<id_token_hint_value>&post_logout_redirect_uri=http://localhost:8080
