# Logout returns 400 “The ID token subject does not match the current session's user” when using two apps with same Okta issuer

**URL:** <https://devforum.okta.com/t/logout-returns-400-the-id-token-subject-does-not-match-the-current-sessions-user-when-using-two-apps-with-same-okta-issuer/34634>\
**Category:** OAuth/OIDC\
**Tags:** ios\
**Created:** [November 27, 2025, 9:31pm UTC](https://devforum.okta.com/t/logout-returns-400-the-id-token-subject-does-not-match-the-current-sessions-user-when-using-two-apps-with-same-okta-issuer/34634 "2025-11-27T21:31:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ysirko](https://avatars.discourse-cdn.com/v4/letter/y/d07c76/32.png) [@ysirko](https://devforum.okta.com/u/ysirko)\
**Post date:** [November 27, 2025, 9:31pm UTC](https://devforum.okta.com/t/logout-returns-400-the-id-token-subject-does-not-match-the-current-sessions-user-when-using-two-apps-with-same-okta-issuer/34634/1 "2025-11-27T21:31:45Z")

</div>

I have two iOS apps that use different Okta client IDs but share the same issuer. Both apps use **[okta-oidc-ios](https://github.com/okta/okta-oidc-ios)** library for authentication.  
When the user logs out in one app and logs back in with a different account, the other app can no longer log out and receives an id\_token\_does\_not\_match\_session error from Okta.

 ![Screenshot 2025-11-27 at 22.48.59](https://global.discourse-cdn.com/oktadev/original/2X/c/c5c368bfecc3ad263426ea5a55b6a68ad513e110.png)

Is there a known/recommended workaround for this multi-app scenario on iOS?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [December 15, 2025, 6:32pm UTC](https://devforum.okta.com/t/logout-returns-400-the-id-token-subject-does-not-match-the-current-sessions-user-when-using-two-apps-with-same-okta-issuer/34634/2 "2025-12-15T18:32:09Z")

</div>

Do you just need to end the Okta session at this point? Or are you just trying to fully log the user out of your application?

One option I can think of is to have your applications both check for the presence of an ID Token within the [stateManager](https://github.com/okta/okta-oidc-ios?tab=readme-ov-file#statemanager) _before_ calling [signOut](https://github.com/okta/okta-oidc-ios?tab=readme-ov-file#signout). If there is no ID token available, your application should instead only complete the application level logout (revoking and clearing tokens) and should not attempt to `signOutFromOkta`

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 14, 2026, 6:32pm UTC](https://devforum.okta.com/t/logout-returns-400-the-id-token-subject-does-not-match-the-current-sessions-user-when-using-two-apps-with-same-okta-issuer/34634/3 "2026-01-14T18:32:50Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.