Hey everyone We're integrating Descope as an OIDC provider with a Salesforce Experience Cloud (Community) site and have the login flow working. Now we're trying to get the logout flow working correctly. *What we want: User clicks Logout → Descope session ends → Salesforce session ends → Redirect to login page What we've built: • A Visualforce page + Apex controller (DescopeLogoutController) that: 1. Retrieves the id_token from Salesforce Org Platform Cache (stored during login via RegistrationHandler) 2. Redirects to https://api.descope.com/oauth2/v1/logout with id_token_hint and post_logout_redirect_uri pointing to /secur/logout.jsp 3. Falls back to direct SF logout if no token found in cache • A custom DescopeRegistrationHandler that caches the id_token under the Portal User's ID at every login (createUser + updateUser) Current concern: We want to confirm that data.idTokenJSONString is reliably populated by Salesforce from Descope's OIDC response — if this is null, our cache is never populated and Descope logout is always skipped. Questions: 1. Is id_token_hint mandatory for the Descope /oauth2/v1/logout endpoint, or will it still end the session without it? 2. Are there any known issues with id_token not being passed back to the Salesforce RegistrationHandler via data.idTokenJSONString? 3. Does the post_logout_redirect_uri need to be whitelisted anywhere beyond the Descope Console OIDC App settings? Any help appreciated!

Hi @Kethineni Tarunteja Thanks for the detailed explanation, your overall approach for coordinating Salesforce + Descope logout looks correct. Let me address your questions one by one. 1. Is

id_token_hint

mandatory for

/oauth2/v1/logout

? For the Descope OIDC logout endpoint, the expected pattern is to call:

<https://api.descope.com/oauth2/v1/logout?id_token_hint=><ID_TOKEN>&post_logout_redirect_uri=<URL>

The

id_token

returned during login is used as the

id_token_hint

when initiating logout. This allows the IdP to identify and terminate the correct session. While logout can still work via session cookies, providing

id_token_hint

is strongly recommended because it ensures the correct user session is invalidated. 2. Could

data.idTokenJSONString

be null in the Salesforce RegistrationHandler? From the Descope side, an ID token is returned as part of the OIDC token exchange during the login flow. If

data.idTokenJSONString

is coming through as

null

, that usually indicates the Salesforce OIDC integration layer is not exposing the ID token to the RegistrationHandler, rather than Descope not issuing one. Things worth confirming on the Salesforce side: • The flow is using Authorization Code OIDC flow • Salesforce Auth Provider is configured to process ID tokens • The token endpoint response contains

id_token

3. Does

post_logout_redirect_uri

need to be whitelisted elsewhere? Yes — the redirect URI used in logout should be allowed in the OIDC application configuration in the Descope Console. This is required so the IdP knows which URLs are valid redirect targets after logout.

My logout vf page and controller in salesforce is these is anything need to be corrected <apex:page controller="DescopeLogoutController" action="{!logout}" showHeader="false" sidebar="false" standardStylesheets="false"> Processing Logout... </apex:page> public with sharing class DescopeLogoutController { public PageReference logout() { String postLogoutRedirect = 'https://safetyscience--ea.sandbox.my.site.com/MyInfo/login'; String descopeBaseUrl = 'https://api.descope.com/zesty-almond-newton/oauth2/v1/logout'; String userId = UserInfo.getUserId(); String idToken = null; try { Cache.OrgPartition partition = Cache.Org.getPartition('local.DescopeTokens'); idToken = (String) partition.get(userId); partition.remove(userId); } catch (Exception e) { System.debug(LoggingLevel.WARN, 'Cache retrieval failed: ' + e.getMessage()); } String finalUrl; if (String.isNotBlank(idToken)) { finalUrl = descopeBaseUrl + '?id_token_hint=' + EncodingUtil.urlEncode(idToken, 'UTF-8') + '&post_logout_redirect_uri=' + EncodingUtil.urlEncode(postLogoutRedirect, 'UTF-8'); System.debug(LoggingLevel.FINE, 'Logout — id_token_hint present, Descope session will be terminated'); } else { System.debug(LoggingLevel.WARN, 'Logout — no id_token found for userId: ' + userId + ', skipping Descope logout'); finalUrl = postLogoutRedirect; } PageReference sfLogout = new PageReference( '/secur/logout.jsp?retUrl=' + EncodingUtil.urlEncode(finalUrl, 'UTF-8') ); sfLogout.setRedirect(true); return sfLogout; } }

Thanks for sharing the VF page and controller, this is very helpful. Overall your implementation looks correct and follows the expected OIDC logout pattern. Since your logout depends on the cached token, it would be worth verifying that the

id_token

is consistently stored during login in the

DescopeRegistrationHandler

. If

data.idTokenJSONString

isn’t populated during login, the cache will never contain the token and the Descope logout step will always be skipped.