# Okta raw logout

**URL:** <https://devforum.okta.com/t/okta-raw-logout/11952>\
**Category:** Questions\
**Created:** [December 1, 2020, 9:26pm UTC](https://devforum.okta.com/t/okta-raw-logout/11952 "2020-12-01T21:26:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![michalkor](https://avatars.discourse-cdn.com/v4/letter/m/ecae2f/32.png) [@michalkor](https://devforum.okta.com/u/michalkor)\
**Post date:** [December 1, 2020, 9:26pm UTC](https://devforum.okta.com/t/okta-raw-logout/11952/1 "2020-12-01T21:26:11Z")

</div>

Hi,

I’m trying to create a logout for my rails app.

As I understand correctly one and only thing that needs to be done is a get request to `/logout?id_token_hint=<id_token_hint>`

another, this time optional, attribute would be post\_logout\_redirect\_uri.

But just `/logout?id_token_hint=<id_token_hint>` should do the trick? Right?

well, I’m getting an error:  
`{"errorCode":"invalid_client","errorSummary":"Invalid value for 'client_id' parameter.","errorLink":"invalid_client","errorId":"oaewWqGO6lqRa6BqmRMYoRAPg","errorCauses":[]}`

for both options (with and without post\_logout\_redirect\_uri). What am I doing wrong?

On okta side I got Logout redirect uris set up to `http://localhost:3000`

---

<div class="post-metadata">

**Author:** ![mraible](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/mraible/32/37_2.png) [@mraible](https://devforum.okta.com/u/mraible)\
**Post date:** [December 2, 2020, 4:21pm UTC](https://devforum.okta.com/t/okta-raw-logout/11952/2 "2020-12-02T16:21:18Z")

</div>

Are you passing an ID token as the value for `id_token_hint`? That’s what it expects.

---

<div class="post-metadata">

**Author:** ![mvernacc](https://avatars.discourse-cdn.com/v4/letter/m/f6c823/32.png) [@mvernacc](https://devforum.okta.com/u/mvernacc)\
**Post date:** [December 11, 2020, 5:07pm UTC](https://devforum.okta.com/t/okta-raw-logout/11952/3 "2020-12-11T17:07:51Z")

</div>

I am getting the same error when try to log out by redirecting the user-agent to the `/logout` endpoint.  
I am passing the (URL-encoded) ID token as the value for `id_token_hint` as a parameter on the URL. The URL looks like:

```auto
https://dev-{...}.okta.com/oauth2/default/v1/logout?id_token_hint=%7B%27access_token%27%3A+%27{...}+%27scope%27%3A+%5B%27profile%27%2C+%27email%27%2C+%27openid%27%5D%2C+%27token_type%27%3A+%27Bearer%27%7D

```

(I have replaced sensitive information with `{...}`)

I am confused because the error mentions a `client_id` parameter, but the [API docs for /logout](https://developer.okta.com/docs/reference/api/oidc/#request-parameters-5) do not list `client_id` as a parameter.

It seems that [Logout Redirect Page](https://devforum.okta.com/t/logout-redirect-page/9824) addresses a similar issue, but the solution was very specific to the poster’s C# implementation, and I am not familiar with C#.

---

<div class="post-metadata">

**Author:** ![mvernacc](https://avatars.discourse-cdn.com/v4/letter/m/f6c823/32.png) [@mvernacc](https://devforum.okta.com/u/mvernacc)\
**Post date:** [December 11, 2020, 6:13pm UTC](https://devforum.okta.com/t/okta-raw-logout/11952/4 "2020-12-11T18:13:06Z")

</div>

I solved my issue! I was not giving the correct value for the `id_token_hint`.  
Details: I am developing a python flask app, and am using `requests_oauthlib` to interact with Okta. To get the token, I call

```auto
token = requests_oauthlib.OAuth2Session.fetch_token(...)

```

The value returned by this method is a dict with a key `'id_token`', along with several other keys. To add the `id_token_hint` to the logout url, I was originally passing the entire dict from `fetch_token`:

```auto
logout_url += '?' + urllib.parse.urlencode(dict(id_token_hint=token))

```

This produced an `"invalid_client"` error from Okta. Instead, I am now passing just the `'id_token`’ value from the dict:

```auto
logout_url += '?' + urllib.parse.urlencode(dict(id_token_hint=token['id_token']))

```

This works.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 9, 2021, 1:48am UTC](https://devforum.okta.com/t/okta-raw-logout/11952/5 "2021-01-09T01:48:44Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.