# Clear User Sessions is not clearing id tokens i.e. user's Okta sessions, only clearing access token and refresh token **URL:** \ **Category:** Questions\ **Created:** [October 24, 2019, 11:09am UTC](https://devforum.okta.com/t/clear-user-sessions-is-not-clearing-id-tokens-i-e-users-okta-sessions-only-clearing-access-token-and-refresh-token/6695 "2019-10-24T11:09:02Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![klele](https://avatars.discourse-cdn.com/v4/letter/k/c67d28/32.png) [@klele](https://devforum.okta.com/u/klele)\ **Post date:** [October 24, 2019, 11:09am UTC](https://devforum.okta.com/t/clear-user-sessions-is-not-clearing-id-tokens-i-e-users-okta-sessions-only-clearing-access-token-and-refresh-token/6695/1 "2019-10-24T11:09:02Z")
Test steps using postman: 1. Get id token, access token, refresh token for a user via password credentials grant type: [https://dev-xxxxxx.oktapreview.com/oauth2/default/v1/token](https://dev-xxxxxx.oktapreview.com/oauth2/default/v1/token) 2. Save the 3 tokens in notepad. 3. Get new set of id token, access token, refresh token for the same user via password credentials grant type: [https://dev-xxxxxx.oktapreview.com/oauth2/default/v1/token](https://dev-xxxxxx.oktapreview.com/oauth2/default/v1/token) 4. Save the new set of 3 tokens in notepad. 5. Invoke as per [Users | Okta Developer](https://developer.okta.com/docs/reference/api/users/#clear-user-sessions:) [https://dev-xxxxxx.oktapreview.com/api/v1/users/${userId}/sessions?oauthTokens=true](https://dev-xxxxxx.oktapreview.com/api/v1/users/%24%7BuserId%7D/sessions?oauthTokens=true) Expected result as per Okta doc: All tokens for the user obtained via steps 1 and 3 revoked. All Okta sessions for the user blown away. Actual result verified by invoking: [https://dev-xxxxxx.oktapreview.com/oauth2/default/v1/introspect](https://dev-xxxxxx.oktapreview.com/oauth2/default/v1/introspect) Access and refresh tokens obtained in steps 1 and 3 revoked. Id tokens obtained in steps 1 and 3 still return active, which indicate that the user’s Okta sessions have still not been blown away. Could an Okta Engineer please conduct a similar postman test and confirm to me that this is not a bug since the doc says that ALL the user’s sessions will be cleared? _Removes all active identity provider sessions. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user._ I have also given the following early access feature a test drive: > **[Users | Okta Developer](https://developer.okta.com/docs/reference/api/users/#user-oauth-2-0-token-management-operations)** > > Secure, scalable, and highly available authentication and user management for any app. Again, this feature only has the provision to revoke all refresh tokens, which also effectively revokes all associated access tokens to the revoke tokens. Great all access and refresh tokens revoked, but here again I am not getting what I want, which is to also blow away all a user’s Okta sessions (id tokens) as well. Thanks, Kapil. ---
**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\ **Post date:** [March 22, 2020, 4:33pm UTC](https://devforum.okta.com/t/clear-user-sessions-is-not-clearing-id-tokens-i-e-users-okta-sessions-only-clearing-access-token-and-refresh-token/6695/2 "2020-03-22T16:33:47Z")
Did you try …/oauth2/default/v1/logout endpoint? It is defined in the authz server metadata under “end\_session\_endpoint” ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [April 25, 2022, 5:18pm UTC](https://devforum.okta.com/t/clear-user-sessions-is-not-clearing-id-tokens-i-e-users-okta-sessions-only-clearing-access-token-and-refresh-token/6695/3 "2022-04-25T17:18:53Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.