Configure Back-Channel Logout
Before you start
To use back-channel logout, your application must meet the following requirements:
Your logout callback endpoint must be exposed over the internet for your Auth0 tenant to access.
Production-ready applications must use TLS.
The application must be able to store the provided session identifier (
sid
) and associate it with the user sessions it creates. We recommend production applications use durable session storage.The application must be able to retrieve an existing session by the
sid
during the logout process without using client-side cookies. Cookies exist within the browser and are inaccessible to the logout callback endpoint.
Verify availability
Check the OIDC standard /.well-known/*
metadata endpoint to determine if the service is available for your application. This is a read-only public endpoint.
GET https://acme.eu.auth0.com/.well-known/openid-configuration
HTTP 200
{ ..., "backchannel_logout_supported": true,
"backchannel_logout_session_supported": true }
Was this helpful?
Back-Channel Logout restrictions
Callback URLs are called on publicly-exposed endpoints and must adhere to certain restrictions:
You must use the HTTPS protocol. Unencrypted HTTP or any other protocols are not allowed.
You must not use Auth0 subdomains. Some Auth0 subdomains are:
auth0.com
auth0app.com
webtask.io
webtask.run
We do not recommend using IP addresses without domains. IP addresses must be public IPs to use back-channel logout. IP addresses from internal, reserved, or loopback ranges are not permitted.
Configure Auth0
Register your application to receive back-channel logout events in Auth0 Dashboard or Management API.
Subscribe applications
Navigate to Auth0 Dashboard > Applications.
Choose the application you want to register.
Select the Settings tab.
Under the OpenID Connect Back-Channel Logout > Back-Channel Logout URI, add the application logout URI that will receive the logout_tokens
Once complete, select Save Changes.
Unsubscribe applications
Unsubscribing your application stops the service from tracking new logins and sending logout events. The service discards pending logout events once your application is unsubscribed.
To unsubscribe your application, delete the back-channel logout URL.
Navigate to Auth0 Dashboard > Applications.
Choose the application you want to register.
Select the Settings tab.
Under the OpenID Connect Back-Channel Logout > Back-Channel Logout URI
Remove the back-channel URL.
Once complete, select Save Changes.
For auditing purposes, the service always logs subscribing or unsubscribing back-channel logout URLs as API Operation Event
in Auth0 tenant logs. To learn more, read Logs.

Subscribe application
Add the oidc_backchannel_logout
property to PATCH
a client through the Management API:
PATCH /api/v2/clients/{id}
"oidc_backchannel_logout": {
"backchannel_logout_urls": ["http://acme.eu.auth0.com/events"]
}
Was this helpful?
Unsubscribe application
Remove the oidc_backchannel_logout
parameter:
PATCH https://acme.eu.auth0.com/api/v2/clients/{id}
{
"oidc_backchannel_logout": {
"backchannel_logout_urls": []
}
}
Was this helpful?
Configure your application
Once you have configured back-channel logout via the Auth0 Dashboard or Management API, configure your application to use the service based on the technology or framework.
Implement end-user authentication according to your application type.
End-users should be able to log in to the application, and a session should be created.
An ID token should be issued from Auth0 and should be accessible in the application backend for further processing.
Extend the login process to save the
sid
and, optionally, sub claims after the ID token is validated.These claims must be saved against the current application session.
The session management functions should be able to retrieve a specific session by the sid value.
Configure the logout callback endpoint:
The endpoint must process only
HTTP POST
requests.Extract the
logout_token
parameter and validate it as a regular JWT according to the spec.Verify that the token contains an events claim with a JSON object value and a member named
http://schemas.openid.net/event/backchannel-logout
.Verify that the token contains the
sid
and/orsub
claims.Verify that the token does NOT contain the
nonce
claim. This is required to prevent abuse by distinguishing the logout token from the ID token.Once the token is validated, retrieve the session corresponding to the received
sid
and/orsub
value and terminate it. The exact application session termination process depends on the implementation details. For example, this event may need to be communicated to the front-end.
Logout callback example
Coded token payload:
POST /backchannel-logout HTTP/1.1
Host: rp.example.org
Content-Type: application/x-www-form-urlencoded
logout_token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InpuTkxvOWZvdXFfVDBSQVg0YnoxeiJ9.eyJpc3MiOiJodHRwczovL2Rldi11ZG8tYXV0aDAuc3VzLmF1dGgwLmNvbS8iLCJzdWIiOiJnb29nbGUtb2F1dGgyfDExMzgxMjk4OTQ2MTg3ODc1MjMxMSIsImF1ZCI6IjQ1RFhtdE5FZVVkTXF6NHRwVkF2WVBsUUVibk1kWmxFIiwiaWF0IjoxNjYzOTMxNDQwLCJqdGkiOiI5NTFkZTVhMy1iZGM3LTQyMTAtYTM0Yy04ZWYyNDk1ZjU5ZTAiLCJldmVudHMiOnsiaHR0cDovL3NjaGVtYXMub3BlbmlkLm5ldC9ldmVudC9iYWNrY2hhbm5lbC1sb2dvdXQiOnt9fSwidHJhY2VfaWQiOiI3NGYyZDVjYjliNzFkMGQ5Iiwic2lkIjoieE52RFluUzZ0emNQNlpVbjl3alBmWTFJaGZDSWFtZ1kifQ.qXLDGHlIglXB-9v-O6fOHj3Y_sB7aIGUjZE0pap4XStPmlzNWIYbaxitBoaZmfS1IrtPubvcu1yOwyxFAjOzKFzU9H_DdLNQ0at7Xx3TEtgyPKVJt5l9wz_pGEpXdLkHHkDsPE-I3RYQzxnuNqfAzFrRHtIxKJL3Sc3VUTldaoWEtYWtfKNOd09bUyJ6mxt9S2kDjrGf6Su3OVi8RerYNlACYX4jzYV1p0oQH5wWzjCoegaFj1ilFRb8AIpTjvOfYrT44pDcLwez-V3FWy9toMnRe8jUcaZ6X0DCbOkzjzMOEKzO93yc2YzYBEktECpVJ6BCEXiPg6DFyxRfqhhyfQ
Was this helpful?
Decoded token payload:
{
"iss": "https://dev-udo-auth0.sus.auth0.com/",
"sub": "google-oauth2|113812989461878752311",
"aud": "45DXmtNEeUdMqz4tpVAvYPlQEbnMdZlE",
"iat": 1663931440,
"jti": "951de5a3-bdc7-4210-a34c-8ef2495f59e0",
"events": {
"http://schemas.openid.net/event/backchannel-logout": {}
},
"trace_id": "74f2d5cb9b71d0d9",
"sid": "xNvDYnS6tzcP6ZUn9wjPfY1IhfCIamgY"
}
Was this helpful?
Expected responses
HTTP 200: Confirms user logout from the specific application.
HTTP 400: Indicates an incorrect request. The request is not understood or the token failed validation. Auth0 records the problem in tenant logs but does not attempt further requests for this specific session.
Troubleshoot issues
Application did not receive the logout events
If your application did not trigger logout and received a 400 error:
Make sure your application has a logout callback URL registered in Auth0 Dashboard.
Ensure the logout callback URL is reachable from the Auth0 tenant.
Ensure a valid session is established. The end-user must log in to your specific application via Auth0.
Check Auth0 tenant logs for messages about unsuccessful logout message delivery. Failed deliveries are not retried.
Make sure the logout is triggered via the standard logout endpoint. Other events do not trigger the logout events.
If possible, check for blocked requests on the web server and/or application firewall logs.
Client app cannot verify the received logout token
If the transaction still fails with a 400 error:
Check if the token is a standard base64-encoded JWT. Some web servers may truncate long parameters. To learn more, read Signing Algorithms.
If possible, capture a token and verify that it’s a JWT. Use a verified source, like JWT.IO.
Make sure the verification function fetches the tenant signing key dynamically via JSON Web Key Sets (JWKS).