> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# Logout

API documentation for the FusionAuth Logout OAuth2 endpoint.

# Logout

This endpoint provides a mechanism to invalidate the user's session held by FusionAuth, this effectively logs the user out of the FusionAuth SSO and any applications by calling a application specific URL.

Calling this endpoint does not revoke refresh tokens or JWTs. You can revoke the former by using the [Revoke Refresh Tokens API](https://fusionauth.io/docs/apis/jwt/revoke-refresh-tokens.md). To revoke JWTs, [implement a revocation strategy](https://fusionauth.io/articles/tokens/revoking-jwts.md).

Since `1.10.0` The logout behavior follows that of the [OpenID Connect Front-Channel Logout](https://openid.net/specs/openid-connect-frontchannel-1_0.html) specification.

The Logout URL used for each application is determined using the following precedence:

1.  The **logoutURL** of the Application if defined.
2.  The **logoutURL** configured on the Tenant if defined.
3.  `/`

You can learn more about this behavior in the [Logout And Session Management guide](https://fusionauth.io/docs/lifecycle/authenticate-users/logout-session-management.md).

## Request

Log the User out of the FusionAuth SSO session using a GET request

GET/oauth2/logout?client\_id={client\_id}&tenantId={tenantId}

### Request Parameters

`client_id`Stringoptional

The unique client identifier. The client Id is the Id of the FusionAuth Application in which you are requesting to logout, this value is used to identify the correct redirect URI.

Generally speaking this parameter is required, if you are using the **id\_token\_hint**, this parameter becomes redundant because the application can be identified based upon the `id_token`.

If you do not provide the **id\_token\_hint** and you also omit this parameter, the request will not fail, but the logout URL defined in the Tenant configuration will be utilized. If the Tenant logout URL is not defined, the request will result in a redirect to the current base URL at the root path of `/`.

`id_token_hint`StringoptionalAvailable since 1.10.0

The `id_token_hint` parameter as described in the [OpenID Connect Session Management](https://openid.net/specs/openid-connect-session-1_0.html#RPLogout) specification.

This is the previously issued `id_token` passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client.

This parameter is only used if `client_id` is not provided.

Note that prior to version `1.37.0` this parameter would only work if it was not expired. This was corrected in version `1.37.0` and as long as the token is signed by FusionAuth, even if expired, the token can be used to identify the user and application during the logout request.

`post_logout_redirect_uri`StringoptionalAvailable since 1.10.0

The URI to redirect to upon a successful logout. This URI must have been configured previously in the FusionAuth Application OAuth configuration as an **Authorized Redirect URL**. See the [Core Concepts OAuth section](https://fusionauth.io/docs/get-started/core-concepts/applications.md#oauth) for additional information on configuring redirect URIs.

If this parameter is omitted, the logout URL defined in the Application OAuth configuration will be utilized. If an Application OAuth logout URL is not defined, the logout URL defined in the Tenant configuration will be utilized. If the Tenant logout URL is not defined, the request will result in a redirect to the current base URL at the root path of `/`.

`state`StringoptionalAvailable since 1.10.0

The `state` parameter as described in the [OpenID Connect Session Management](https://openid.net/specs/openid-connect-session-1_0.html#RPLogout) specification. This is an opaque value used to maintain state between the logout request and the callback.

`tenantId`UUIDrequiredAvailable since 1.8.0

The unique Tenant Id used for applying the proper theme.

version

Available since version 1.37.0

Log the User out of the FusionAuth SSO session with a POST request

POST/oauth2/logout

### Request Body

`client_id`Stringoptional

The unique client identifier. The client Id is the Id of the FusionAuth Application in which you are requesting to logout, this value is used to identify the correct redirect URI.

Generally speaking this parameter is required, if you are using the **id\_token\_hint**, this parameter becomes redundant because the application can be identified based upon the `id_token`.

If you do not provide the **id\_token\_hint** and you also omit this parameter, the request will not fail, but the logout URL defined in the Tenant configuration will be utilized. If the Tenant logout URL is not defined, the request will result in a redirect to the current base URL at the root path of `/`.

`id_token_hint`Stringoptional

The `id_token_hint` parameter as described in the [OpenID Connect Session Management](https://openid.net/specs/openid-connect-session-1_0.html#RPLogout) specification.

This is the previously issued `id_token` passed to the logout endpoint as a hint about the End-User's current authenticated session with the Client.

This parameter is only used if `client_id` is not provided.

Note that prior to version `1.37.0` this parameter would only work if it was not expired. This was corrected in version `1.37.0` and as long as the token is signed by FusionAuth, even if expired, the token can be used to identify the user and application during the logout request.

`post_logout_redirect_uri`Stringoptional

The URI to redirect to upon a successful logout. This URI must have been configured previously in the FusionAuth Application OAuth configuration as an **Authorized Redirect URL**. See the [Core Concepts OAuth section](https://fusionauth.io/docs/get-started/core-concepts/applications.md#oauth) for additional information on configuring redirect URIs.

If this parameter is omitted, the logout URL defined in the Application OAuth configuration will be utilized. If an Application OAuth logout URL is not defined, the logout URL defined in the Tenant configuration will be utilized. If the Tenant logout URL is not defined, the request will result in a redirect to the current base URL at the root path of `/`.

`state`Stringoptional

The `state` parameter as described in the [OpenID Connect Session Management](https://openid.net/specs/openid-connect-session-1_0.html#RPLogout) specification. This is an opaque value used to maintain state between the logout request and the callback.

`tenantId`UUIDrequired

The unique Tenant Id used for applying the proper theme.

## Response

*Response Codes*

| Code | Description |
| --- | --- |
| 302 | The request was successful and the redirect location will be determined by using the configuration values in the following precedence:  
\* The `post_logout_redirect_uri` request parameter if present  
\* The **logoutURL** defined in the Application OAuth configuration  
\* The **logoutURL** defined in the Tenant OAuth configuration  
\* `/` |
| 400 | The request was invalid and/or malformed. The response will contain a JSON message with the specific errors. The error response JSON is covered in the [OAuth Error section](https://fusionauth.io/docs/apis/oauth/oauth-error.md) of the API documentation. |
| 500 | There was a FusionAuth internal error. A stack trace is provided and logged in the FusionAuth log files. |
| 503 | The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body. |