Hello, I have added a federated application which is Generic OIDC Provider. When I try to set logout backchannel url and initiate logout I get error "`{"errorCode":"E066011","errorDescription":"Failed to perform OIDC back channel logout request","errorMessage":"request failed","message":"request failed"}`"

Based on the error code E066011 and the "Failed to perform OIDC back channel logout request" message, this appears to be an issue with the back channel logout URL configuration or the target endpoint's response. Let me provide troubleshooting steps for this specific error. Back Channel Logout Configuration Issue The error E066011 indicates Descope cannot successfully make the back channel logout request to your configured URL. Common Causes and Solutions 1. Verify the back channel logout URL is accessible - Ensure the URL is publicly accessible from Descope's servers - Test the endpoint manually with a POST request - Check for any firewall or network restrictions 2. Validate endpoint requirements - The endpoint must accept POST requests - It should return a 200 status code for successful logout - Verify it can handle the logout token format Descope sends 3. Check URL format and configuration - Ensure the URL is properly formatted (https://your-domain.com/logout) - Verify there are no typos in the configured URL - Confirm the endpoint path matches your application's logout handler Debugging Steps • Check your application logs to see if the logout requests are reaching your endpoint • Verify your logout endpoint returns appropriate HTTP status codes • Test the logout flow with a simpler endpoint first to isolate the issue • Ensure your Generic OIDC Provider configuration includes all required fields The documentation doesn't cover this specific error code in detail. I'd recommend checking your logout endpoint's accessibility and response format, and confirming with Descope support if the issue persists after verifying these common causes.

I have added test endpoint:

curl -X POST <https://unschizophrenic-constrained-daryl.ngrok-free.dev/descope-logt>  -H "Content-Type: application/json"  -d '{"a":"b"}'

• it returns 200 • the request body and url are undefined

Endpoint Response Analysis Your test endpoint returns 200, which is correct, but the "request body and url are undefined" suggests the issue is with how your endpoint handles the incoming request. Back Channel Logout Request Format Descope sends back channel logout requests with specific parameters:

POST /your-logout-endpoint
Content-Type: application/x-www-form-urlencoded
logout_token=<JWT_TOKEN>

Fix Your Endpoint Handler 1. Change content type handling - Your endpoint should expect

application/x-www-form-urlencoded

, not JSON - The logout token comes as a form parameter, not JSON body 2. Update your test endpoint

// Example Node.js/Express handler
<http://app.post|app.post>('/descope-logout', (req, res) => {
  console.log('Headers:', req.headers);
  console.log('Body:', req.body);
  console.log('Logout token:', req.body.logout_token);
  
  // Process the logout token here
  res.status(200).send('OK');
});

Verify Configuration • Ensure your Generic OIDC Provider's back channel logout URL points to:

<https://unschizophrenic-constrained-daryl.ngrok-free.dev/descope-logout>

• Your endpoint must parse form-encoded data, not JSON • The logout token will be a JWT that you can decode to get session information The undefined body/URL indicates your endpoint isn't properly configured to handle the form-encoded logout request format that Descope sends.

I have update content type and now i can see logout token. My endpoint is returning status:200, OK, and I still see error: {"errorCode":"E066011","errorDescription":"Failed to perform OIDC back channel logout request","errorMessage":"request failed","message":"request failed"}

SSL/TLS Certificate Issue Since your endpoint is receiving the logout token and returning 200 OK, but Descope still reports "request failed", this is likely an SSL certificate validation issue with your ngrok endpoint. Immediate Solutions 1. Test with a valid SSL endpoint - Deploy a simple logout handler to a service with proper SSL (Vercel, Netlify, etc.) - Or use a webhook testing service like webhook.site temporarily 2. Verify ngrok configuration - Ensure you're using

https://

(not

http://

) in your back channel logout URL - Check if ngrok is properly forwarding HTTPS requests Debug the SSL Issue

# Test SSL certificate validity
curl -v <https://unschizophrenic-constrained-daryl.ngrok-free.dev/descope-logout>

Alternative Testing Approach Use webhook.site for immediate testing: 1. Go to https://webhook.site 2. Copy the unique URL 3. Set that as your back channel logout URL in Descope 4. Test the logout flow and check the webhook.site logs Root Cause Descope's servers likely cannot validate the SSL certificate on your ngrok tunnel, causing the request to fail from their perspective even though your endpoint processes it correctly. This is common with development tunneling services. Try the webhook.site test first to confirm this theory, then deploy to a proper SSL-enabled endpoint for production use.

I have tested the certificates are okay, is there any way to check the actual error in descope? in Audits and troubleshooting there is nothing

Check Descope Logs and Debugging Since your SSL certificates are valid and the endpoint works, let's check Descope's internal logging: Audit Logs Location 1. Console → Audit Logs - Go to Descope Console → Audit Logs - Filter by timestamp when you tested the logout - Look for entries related to "logout" or "backchannel" 2. Project Settings → Logs - Check if there are more detailed error logs in Project Settings - Look for webhook or federation-related errors Enable Debug Mode

# Test with verbose logging if available
# Check your Generic OIDC Provider settings for debug options

Alternative Debugging Since Audit Logs show nothing, the error might be at the network level: 1. Check your endpoint logs during Descope's request - Monitor exactly what Descope sends vs what you expect - Verify the User-Agent, headers, and request format 2. Test with a different endpoint - Try a simple webhook service to isolate if it's endpoint-specific - Use a service like RequestBin or webhook.site Contact Support Given that you have a specific error code (E066011) but no audit trail, this may require Descope engineering to check their internal logs. The lack of audit entries suggests the failure happens before the request completes their logging pipeline. I'd recommend reaching out to Descope support with your project ID and the specific timestamp when you tested - they can check server-side logs that aren't exposed in the console.

i have already said that there is nophing in audit, and there is no such thing as project settings - logs

Escalation Required Error E066011 with no audit trail requires Descope support to check server-side logs that aren't exposed in the console. They'll need your: • Project ID • Exact timestamp of the failed logout attempt • Your back channel logout URL • Confirmation that your endpoint returns 200 OK This type of infrastructure-level debugging requires access to Descope's internal request logs to determine why the request is marked as "failed" despite your endpoint responding correctly.

Project ID: Peuc13ANrrVqtOsp6Oh4yySu5fR1lKW8 url: https://unschizophrenic-constrained-daryl.ngrok-free.dev/descope-logout time: 3/3/2026 9:21 GMT

Perfect - I've escalated this to Descope support with your details: • Project ID: Peuc13ANrrVqtOsp6Oh4yySu5fR1lKW8 • URL: https://unschizophrenic-constrained-daryl.ngrok-free.dev/descope-logout • Timestamp: 3/3/2026 9:21 GMT • Error: E066011 with no audit trail despite endpoint returning 200 OK A support engineer will investigate the server-side logs to determine why the back channel logout request is failing from Descope's perspective.

Hey, any update o this?