# Okta logging out

**URL:** <https://devforum.okta.com/t/okta-logging-out/28007>\
**Category:** OAuth/OIDC\
**Created:** [May 1, 2024, 2:17am UTC](https://devforum.okta.com/t/okta-logging-out/28007 "2024-05-01T02:17:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![VuLe](https://avatars.discourse-cdn.com/v4/letter/v/a5b964/32.png) [@VuLe](https://devforum.okta.com/u/VuLe)\
**Post date:** [May 1, 2024, 2:17am UTC](https://devforum.okta.com/t/okta-logging-out/28007/1 "2024-05-01T02:17:49Z")

</div>

I’m trying to implement logging out for Okta in a NodeJs app, where if the user sign out, the app logs out of the Okta session, and subsequent sign in requires going through Okta SSO again. I see this route:  
GET https://${baseUrl}/logout?id\_token\_hint=${id\_token}

I don’t know what the {id\_token} is and how to get it.

My current implementation is:

```auto
let id_token
passport.use('oidc', new Strategy({
  issuer: `https://${OKTA_DOMAIN}/oauth2/default`,
  authorizationURL: `https://${OKTA_DOMAIN}/oauth2/default/v1/authorize`,
  tokenURL: `https://${OKTA_DOMAIN}/oauth2/default/v1/token`,
  userInfoURL: `https://${OKTA_DOMAIN}/oauth2/default/v1/userinfo`,
  clientID: `${CLIENT_ID}`,
  clientSecret: `${CLIENT_SECRET}`,
  callbackURL: `http://localhost:${PORT}/authorization-code/callback`,
  scope: 'openid profile'
}, (issuer, profile, context, idToken, accessToken, refreshToken, params, done) => {
  console.log(`OIDC response: ${JSON.stringify({
    issuer, profile, context, idToken,
    accessToken, refreshToken, params
  }, null, 2)}\n ***** `);
  id_token = idToken;
  return done(null, profile);
}));

```

However, the token returned is invalid, and I got a 400 error instead.

Any help is appreciated

---

<div class="post-metadata">

**Author:** ![nicole](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nicole](https://devforum.okta.com/u/nicole)\
**Post date:** [May 15, 2024, 7:39pm UTC](https://devforum.okta.com/t/okta-logging-out/28007/2 "2024-05-15T19:39:24Z")

</div>

Here’s some information about ID Tokens

- [OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#token)
- [Validate ID tokens | Okta Developer](https://developer.okta.com/docs/guides/validate-id-tokens/main/)
- [Implement authorization by grant type | Okta Developer](https://developer.okta.com/docs/guides/implement-grant-type/authcode/main/)

Are you using one of our sdks? Do you get an idToken in the response that you’re logging?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [June 16, 2024, 9:52am UTC](https://devforum.okta.com/t/okta-logging-out/28007/4 "2024-06-16T09:52:59Z")

</div>

Closed on June 16, 2024, 9:52am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.