# Logout of Okta from Cognito IdP

**URL:** <https://devforum.okta.com/t/logout-of-okta-from-cognito-idp/5137>\
**Category:** Questions\
**Created:** [May 16, 2019, 8:03pm UTC](https://devforum.okta.com/t/logout-of-okta-from-cognito-idp/5137 "2019-05-16T20:03:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jcarlson5](https://avatars.discourse-cdn.com/v4/letter/j/b5a626/32.png) [@jcarlson5](https://devforum.okta.com/u/jcarlson5)\
**Post date:** [May 16, 2019, 8:03pm UTC](https://devforum.okta.com/t/logout-of-okta-from-cognito-idp/5137/1 "2019-05-16T20:03:33Z")

</div>

I have a standard web application and have setup Amazon Cognito as the primary identity provider. Additionally, in Cognito, I have enabled Okta as an upstream Identity Provider. This allows users to login with either a username and password managed by Cognito, or their account with my company’s enterprise Okta organization.

Cognito includes a logout endpoint for terminating SSO sessions at the Cognito level; this works fine for users who originally logged in with a Cognito username and password.

However, for users who logged in with an Okta id, my application never receives the ID token or access token issued by _Okta_; after successful authentication, Cognito issues its own ID token and access token that are passed back to the application.

I am aware that Okta does have a logout API endpoint; however, this API endpoint required the Okta-issued ID token in order to terminate the user’s Okta session.

Therefore, it is impossible for my application to properly logout a user because, upon successful logout from Cognito, Cognito is able to immediately authenticate the user again using the still-active Okta session.

How can I get the user’s Okta session terminated without knowing the ID token that Okta issued to Cognito?

---

<div class="post-metadata">

**Author:** ![dnyabuti](https://avatars.discourse-cdn.com/v4/letter/d/47e85d/32.png) [@dnyabuti](https://devforum.okta.com/u/dnyabuti)\
**Post date:** [December 10, 2020, 12:58am UTC](https://devforum.okta.com/t/logout-of-okta-from-cognito-idp/5137/2 "2020-12-10T00:58:28Z")

</div>

@jcarlson5, did you find a solution for this issue? I have the same problem.

---

<div class="post-metadata">

**Author:** ![micah-redwood](https://avatars.discourse-cdn.com/v4/letter/m/7cd45c/32.png) [@micah-redwood](https://devforum.okta.com/u/micah-redwood)\
**Post date:** [October 24, 2023, 4:59pm UTC](https://devforum.okta.com/t/logout-of-okta-from-cognito-idp/5137/3 "2023-10-24T16:59:22Z")

</div>

+1 Having the same issue, any support would be appreciated!

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 13, 2024, 12:28am UTC](https://devforum.okta.com/t/logout-of-okta-from-cognito-idp/5137/4 "2024-02-13T00:28:00Z")

</div>

Closed on February 13, 2024, 12:28am UTC


