# \[OIDC\] Logout without having the original Id Token

**URL:** <https://devforum.okta.com/t/oidc-logout-without-having-the-original-id-token/34344>\
**Category:** OAuth/OIDC\
**Tags:** logout\
**Created:** [September 26, 2025, 9:03am UTC](https://devforum.okta.com/t/oidc-logout-without-having-the-original-id-token/34344 "2025-09-26T09:03:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ravina](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@ravina](https://devforum.okta.com/u/ravina)\
**Post date:** [September 26, 2025, 9:03am UTC](https://devforum.okta.com/t/oidc-logout-without-having-the-original-id-token/34344/1 "2025-09-26T09:03:23Z")

</div>

The ALB forwards Okta’s original `access_token` to our apps, but instead of forwarding Okta’s ID Token, AWS composes a new one with the claims obtained from the `/userinfo` endpoint, signs this token and forwards it to our apps

The problem comes when we want to logout the user from the application and Okta’s authorization server (so that user has to enter credentials again in Okta’s login page).

Okta’s documentation for the `/logout` endpoint asks for an ID Token being passed in the `id_token_hint` query parameter but our applications don’t have access to Okta’s ID token, but rather AWS’s one

- Has anybody dealt with this issue before and found a workaround?

- Is there a way to obtain an ID Token from Okta after the token exchange if we posses a valid access token?

- Is there any other way of logging our users from the app in Okta?

Thanks in advance for your help!

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [September 26, 2025, 3:16pm UTC](https://devforum.okta.com/t/oidc-logout-without-having-the-original-id-token/34344/2 "2025-09-26T15:16:57Z")

</div>

Do you only have a valid access token? Would it be possible to be forwarded along a refresh token as well? That way your application could refresh the users tokens and, as long it is requesting the `openid` scope, receive an ID token.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [October 26, 2025, 3:17pm UTC](https://devforum.okta.com/t/oidc-logout-without-having-the-original-id-token/34344/3 "2025-10-26T15:17:07Z")

</div>

Closed on October 26, 2025, 3:17pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.