Using the /logout Endpoint and Revoking User Tokens Within Okta
Last Updated:
Overview
Okta terminates the session when using the /logout endpoint but does not invalidate active Access and Refresh tokens. To prevent tokens from accessing the /userinfo endpoint after logout, administrators must make a separate call to the /revoke endpoint.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC)
- OAuth 2.0 Tokens
- Single Logout (SLO)
Cause
There are a few differences between logout and revoke:
- Revoke Token: Makes sure that the user's Access and Refresh Tokens are invalidated, preventing further use in
userinfoendpoint. - Logout Endpoint: Terminate Okta session.
Okta clears the cookies from the session when using the /logout endpoint but does not invalidate issued Access or Refresh tokens on the server. Because Okta does not automatically trigger token revocation during logout, the tokens remain valid. If the tokens possess a long expiration time, they can still access the /userinfo endpoint until they expire.
Solution
Why is a separate call to the revoke endpoint necessary?
Administrators must make a separate call to the /revoke endpoint to invalidate the access token and the refresh token.
Okta SDKs often combine the logout and revocation steps in a single method. For example, okta-auth-js library the okta-auth-js library signout() method ends the Okta and application sessions and revokes the access and refresh tokens using the default settings.
NOTE: This article does not cover Native Single Sign-On (SSO) and applies only to OAuth 2.0 flows.
