Hi Descope team! I’m integrating with AWS ALB via OIDC. Since the ALB handles the flow, it forwards the Access Token in the headers but not the ID Token. I need to trigger a logout, but your standard logout endpoint seems to require the

id_token_hint

. Is there a way to perform a logout using only the Access Token, or perhaps an alternative endpoint that doesn't require the ID token hint? Thanks!

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. The Core Limitation Descope's OIDC End Session Endpoint (`https://api.descope.com/oauth2/v1/logout`) requires

id_token_hint

to identify and terminate the user session. There is no documented alternative logout endpoint that accepts only an access token in place of the ID token hint. Available Workarounds Since AWS ALB only forwards the access token, here are the practical alternatives Oren can consider: 1. Token Revocation Endpoint Descope exposes a dedicated revocation endpoint that can revoke tokens directly:

POST <https://api.descope.com/oauth2/v1/revoke>

This endpoint accepts a

token

parameter and can be used server-side with just the access token to invalidate it, without needing the

id_token_hint

. This is the closest functional equivalent to logout in this scenario. 2. Store the ID Token Server-Side If the application backend handles the OIDC token exchange (authorization code → tokens), it can store the

id_token

server-side at login time and retrieve it when logout is needed — even if ALB only forwards the access token downstream. 3. Use Descope's Management API If applicable, consider using Descope's Management API to manage user sessions and tokens effectively.

Hi @Oren Pinkas Totally understandable friction with ALB — it only passes the access token downstream, so

id_token_hint

isn't naturally available. A couple of options here: Option 1 — Revoke the access token directly Use Descope's token revocation endpoint:

POST <https://api.descope.com/oauth2/v1/revoke>

Pass the access token as the

token

parameter. This invalidates the token server-side without needing the ID token. It's the quickest path if you just need the session to stop working. Option 2 — Logout via Management API Decode the access token (it's a JWT) to extract the user's

sub

claim, then use Descope's Management API to revoke all active sessions for that user. Cleaner end-to-end logout if you need full session termination. Option 3 — Store the ID token at login time If your backend handles the initial OIDC token exchange, store the

id_token

there and retrieve it when logout is triggered. More setup, but lets you use the standard logout endpoint as-is. Most teams in your setup go with Option 1 or 2 — depends on whether you need full session invalidation or just token revocation. Please let me know if this helps!

Thank you @Akash Jivane, can you please provide more details of the "revoke all sessions" endpoint in the Management API ?

Hi @Oren Pinkas Here are the details for the Management API logout endpoint:

POST <https://api.descope.com/v1/mgmt/user/logout>
Authorization: Bearer <ProjectID>:<ManagementKey>
Content-Type: application/json

{
  "userId": "<user_id>"
}

You can grab the

userId

by decoding the access token (JWT) and pulling the

sub

claim — that's the user ID. You'll also need a Management Key from your Descope console under Settings → Company → Management Keys. This will log the user out of all active sessions across devices. Let me know if this works for you!

Thank you!!