400 Bad Request ! Invalid Id_token - /logout endpoint calling. (SSO Embedded SignIn Widget - OIDC web App)

[Saurabh126]

Hi Team,

I am trying to call /login endpoint using C#.Net by following the instruction from OKTA doc

however, I am getting bad request error message saying “Invalid id_token” from Postman and from C# code too as shown below.
Please guide me through If there is any correction required to fix this issue

*****************************************************************************************
Sharing request API call
https://xxxxxx-dev.oktapreview.com/oauth2/v1/logout?id_token_hint=eyJraWQiOiJzNENxb2tTaGRQWm9YazVmVTUyM3p1SGNyNDdIazFfdkhveHM5SjdPUGNZIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiIwMHU3aDhwcm9qc08zSHlKOTFkNyIsIm5hbWUiOiJTYXVyYWJoIFNoYXJtYSIsInZlciI6MSwiaXNzIjoiaHR0cHM6Ly9jbGluaWNhbGluay1kZXYub2t0YXByZXZpZXcuY29tL29hdXRoMi9kZWZhdWx0IiwiYXVkIjoiMG9hNmFyNHFjakxoWElqaWMxZDciLCJpYXQiOjE2ODEyMzA3NTYsImV4cCI6MTY4MTIzNDM1NiwianRpIjoiSUQuMEpQdWhsVlFXRlYtaWw4QVlNNi15bkQ3X0FaREZVS2hJNV9Ldlo0MDJjQSIsImFtciI6WyJwd2QiXSwiaWRwIjoiMDBvNjNmM21ra0V4akdLSHExZDciLCJub25jZSI6Ilp0YksxWUp0Rk1IV014cUN0V3ZLZE00QlduSEkyTkFpZmJSSURFaTExODlQdFFiZ1ZpdE1SYnpOaUt3Z0pVc1MiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJzYXVyYWJoLnRlc3RtZSIsImF1dGhfdGltZSI6MTY4MTIyNDcyNSwiYXRfaGFzaCI6InhfZGFybm1Xb2twUDRoNzZHek0ydXcifQ.YplkMfRBpcR9lC1hs8DydOxW0v_NuuqxKh0WVctIUFTFtrsNiv5yrsM421AMUieji1CBN_h98wYlClvqMGKkWyq_tAVC2v3Cmby7bePKgSmrr0UKLLJMOuWGerr1B5h8bWUnaqbLb8Emdw0fUVPDImOtkgt39VDQ3HUx1kczjitsPWVd02cIGWXayFkPFaCrtRgOzyVXQZXgBuJhBD3f2KPogURGSmETvoxkOIyeQiNsbECWJzeHzPKuuvL9ROYfF5vZXzSDR0RkF5-sSxhhR2A0_QaxP73aMmrqwf7BWWbrVisbiI4EusFb_L2LBzU3r_E8PrlnHK35y5Ym_a5yCw

Regards,
Saurabh

[erik]

Hello,

The most likely reason for this is you may have used a different authorization server to authorize and get tokens, for example,
https://{domain}.oktapreview.com/oauth2/default

Then in the logout call you are using,
https://{domain}.oktapreview.com/oauth2/v1/logout
instead of,
https://{domain}.oktapreview.com/oauth2/default/v1/logout

[andrea]

I see a different iss within that ID token than what you have in the request URL, namely that the token was issued by the “Default” Authorization server, but your /logout endpoint shows you trying to send it to the Org Authorization Server instead. Can you change the request domain/path so that it matches iss + /v1/logout, e.g.:

https://xxxxxx-dev.oktapreview.com/oauth2/default/v1/logout?id_token_hint=xxxx

[Saurabh126]

Thank you @andrea for your help