# Invalid client\_id on logout **URL:** \ **Category:** OAuth/OIDC\ **Created:** [November 17, 2022, 8:16pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472 "2022-11-17T20:16:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![gtibbitts](https://avatars.discourse-cdn.com/v4/letter/g/c2a13f/32.png) [@gtibbitts](https://devforum.okta.com/u/gtibbitts)\ **Post date:** [November 17, 2022, 8:16pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/1 "2022-11-17T20:16:29Z")
I am integrating an old spring application with okta. I’m using the mitreid spring library and authentication is working fine, however when I attempt to logout, I get invalid client\_id. I have read the posts indicating this is caused by using the wrong token or a badly formatted token. I have decoded my token and it appears to be correct. I have used the introspect endpoint and it says the token is not active. Can someone help me understand what is wrong with the token. I may have to modify the token encoding in the mitreid library so okta recognizes it. Please let me know what I need to provide to help research this. From what I understand, the okta support team has access to the id tokens I have used to attempt logout. Earlier I had utilized invalid tokens, but the last few requests should be valid. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [November 17, 2022, 8:32pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/2 "2022-11-17T20:32:27Z")
What is the `iss` value in the ID token you have? What are the introspect and /logout endpoints you are trying to use, do they look like [https://org.okta.com/oauth2/v1/logout](https://org.okta.com/oauth2/v1/logout) OR [https://org.okta.com/oauth2/default/v1/logout](https://org.okta.com/oauth2/default/v1/logout) OR [https://org.okta.com/oauth2/ausxxxxxxxx/v1/logout](https://org.okta.com/oauth2/ausxxxxxxxx/v1/logout)? If you navigate to `iss` + /.well-known/openid-configuration, does the `end_session_endpoint` match the URL you are trying to use for your /logout request? ---
**Author:** ![gtibbitts](https://avatars.discourse-cdn.com/v4/letter/g/c2a13f/32.png) [@gtibbitts](https://devforum.okta.com/u/gtibbitts)\ **Post date:** [November 18, 2022, 9:18pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/3 "2022-11-18T21:18:20Z")
This is the value of the iss property in the token: [https://dev-41814438.okta.com/oauth2/default](https://dev-41814438.okta.com/oauth2/default) It matches the end\_session\_endpoint in .well-known/openid-configuration which is [https://dev-41814438.okta.com/oauth2/default/v1/logout](https://dev-41814438.okta.com/oauth2/default/v1/logout) ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [November 18, 2022, 9:34pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/4 "2022-11-18T21:34:42Z")
And you’re making this request in the same browser in which the user has an Okta session? Also, watch out for these error conditions: [OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#error-conditions) ---
**Author:** ![gtibbitts](https://avatars.discourse-cdn.com/v4/letter/g/c2a13f/32.png) [@gtibbitts](https://devforum.okta.com/u/gtibbitts)\ **Post date:** [November 18, 2022, 10:40pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/5 "2022-11-18T22:40:12Z")
Correct. That’s why I believe the id token is invalid, but I don’t know why because when I view the decoded contents, it appears correct. Do you have a decoded valid token I could use as a reference to compare? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [December 27, 2022, 6:31pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/6 "2022-12-27T18:31:11Z")
For the token you looked at, was the `exp` value within it set in the future or the past? Is the token actually still valid at this point? ---
**Author:** ![gtibbitts](https://avatars.discourse-cdn.com/v4/letter/g/c2a13f/32.png) [@gtibbitts](https://devforum.okta.com/u/gtibbitts)\ **Post date:** [December 28, 2022, 1:25pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/7 "2022-12-28T13:25:10Z")
I found the issue. I was submitting the token without the signature at the end. The oidc library I’m using was a bit confusing to get the entire token value. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [December 29, 2022, 1:25pm UTC](https://devforum.okta.com/t/invalid-client-id-on-logout/22472/8 "2022-12-29T13:25:25Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.