Okta Integration Wizard: Universal Logout settings

Fields for configuring Universal Logout to revoke user sessions across your integration. The available fields vary based on the capabilities you selected.

Universal Logout with Global Token Revocation (GTR)

Read Build Universal Logout for your app before you configure Universal Logout with GTR.

Table 1. Universal Logout with GTR fields
Field Description
Global token revocation endpoint

Specify your GTR endpoint. If your endpoint URL is dynamic, use the variables that are specified in the Integration variables section. For example: https://' + app.subdomain + '.example.org/strawberry/login. See Dynamic properties with Okta Expression Language.

The maximum field length is 1024 characters.

This is a required field.
Authentication method

Specifies the authentication method that's used for Universal Logout. Okta only supports SIGNED_JWT.
Subject format

Specify how the user is identified in the logout request for your app. The default value is Email.

  • Email: Your integration uses the email address of the user.

  • Issuer and Subject identifier: Your integration uses the user identifier.
Partial support

Select if you only require partial Universal Logout support for your app.

Note: If you select this option, while clearing the user's session from Okta, the app only revokes the user's refresh tokens. This prevents the user from getting new access in the future. However, the existing user sessions aren't terminated until the user's existing access tokens expire or the user signs out of an app.

Universal Logout with API Integration Actions

Table 2. Universal Logout with API Integration Actions fields
Field Description
Proprietary

Specify the flow for Universal Logout in your app.

This is a required field.