Okta Access Gateway Global Token Revocation Fails After Application Update

Okta Access Gateway (OAG) Global Token Revocation (GTR) fails for new and updated applications due to an updated API endpoint in Okta that ignores the GTR-specific request. Enabling GTR directly through the Okta Admin Console resolves the issue. GTR fails to function for new applications and ceases to function for existing applications after an administrator updates them in the OAG Admin UI.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Global Token Revocation (GTR)

Okta updated the API endpoint that handles GTR. Consequently, Okta ignores the GTR-specific request when OAG sends the application payload during application creation or updates. The OAG payload request update is available in the October 2025 release. For OAG versions prior to October 2025, administrators must apply the solution each time a new application is created or an existing application is updated to enable GTR functionality.

How is Global Token Revocation enabled for affected applications?

Enable GTR through the Okta Admin Console by editing the logout settings for the affected application.

1. Log in to the Okta Admin Console.
2. Search for the affected OAG application in the search bar or navigate to Applications.
3. Select the application to open the detailed view.
4. Navigate to the General tab and edit the Logout section.
5. Select the Okta system or admin initiates logout checkbox.
6. Enter https://<public_domain>/oag-session/gtr in the Endpoint URL field, replacing <public_domain> with the public domain of the affected OAG application (for example, header.domain.tld).
7. Choose Email Identifier for the Subject format.
8. Select Save.

Review the example configuration for the logout section.