Logout

The Logout endpoints enable the RP-initiated logout functionality for users in your application. Refer to Single Logout section for more details on how to handle RP-initiated or IdP-initiated logout.

You should call this endpoint from your server to generate a logout token which is required for the Logout Redirect endpoint.

curl --request POST \
  --url "https://auth.workos.com/sso/logout/authorize" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "profile_id": "prof_01HXYZ123456789ABCDEFGHIJ"
    }
BODY

Logout allows to sign out a user from your application by triggering the identity provider sign out flow. This GET endpoint should be a redirection, since the identity provider user will be identified in the browser session.

Before redirecting to this endpoint, you need to generate a short-lived logout token using the Logout Authorize endpoint.

curl "https://auth.workos.com/sso/logout" \
  -G \
  -d token=eyJhbGciOiJSUzI1NiJ9