---
title: "Build and Integrate Universal Logout with Okta"
description: "The tutorial builds Universal Logout for an OIDC-enabled SaaS Todo application so enterprise administrators can end suspicious user sessions after account compromise or other detected risk. It explains how to create a /global-token-revocation endpoint, connect it to the Express app, identify a user from the revocation request, and invalidate that user's application session. Initial protection uses an API key, while the updated flow upgrades authorization to OAuth 2.0 Private Key JWT with the Okta JWT Verifier library. The tutorial then exposes the endpoint publicly, configures Okta Admin Console integration, and describes optional OIN submission with Private Key JWT and an email identifier for sub_id. In the test, an admin clears the user's sessions and tokens; the Todo app redirects the user to login when they attempt to add a task, demonstrating Universal Logout works."
---

# Build and Integrate Universal Logout with Okta

[Okta](https://yomu.fyi/company/okta) · Semona Igama · Apr 30, 2024

**Type:** Tutorial

## Summary

The tutorial builds Universal Logout for an OIDC-enabled SaaS Todo application so enterprise administrators can end suspicious user sessions after account compromise or other detected risk. It explains how to create a /global-token-revocation endpoint, connect it to the Express app, identify a user from the revocation request, and invalidate that user's application session. Initial protection uses an API key, while the updated flow upgrades authorization to OAuth 2.0 Private Key JWT with the Okta JWT Verifier library. The tutorial then exposes the endpoint publicly, configures Okta Admin Console integration, and describes optional OIN submission with Private Key JWT and an email identifier for sub\_id. In the test, an admin clears the user's sessions and tokens; the Todo app redirects the user to login when they attempt to add a task, demonstrating Universal Logout works.

## Context

The guide uses a Todo sample application with OpenID Connect single sign-on, an Okta Integrator Free Plan account, and a local Prisma database. It is presented as part of an on-demand workshop series for making SaaS applications more enterprise-ready.

## Approach / What changed

Implement an Express POST route at /global-token-revocation, add logic to locate the affected user and end their session, and initially protect the route with an API key. Then expose the endpoint publicly, replace API-key authorization with OAuth 2.0 Private Key JWT using the Okta JWT Verifier library, configure Okta to call it, and enable an administrator to initiate logout from the Okta Admin Console.

## Takeaways

- The Universal Logout endpoint is /global-token-revocation and should return 204 No Content on a successful revocation request, with an appropriate error code such as 400 or 404 for failures.
- The tutorial first secures the endpoint with an API key, then upgrades it to OAuth 2.0 Private Key JWT authorization using the Okta JWT Verifier library.
- Cookie-based sessions are used for the web application; mobile apps and single-page applications need front-end refresh-token revocation for a successful sign-out.

## FAQ

### How does an Okta administrator trigger Universal Logout?

The administrator opens the user in the Okta Admin Console, chooses More Actions, then Clear User Sessions. Selecting the option to include Logout enabled apps and Okta API tokens sends the revocation flow, after which the Todo app requires the user to sign in again.

### Why does the tutorial upgrade from an API key to Private Key JWT?

The initial endpoint is secured with an API key for testing. The updated integration uses OAuth 2.0 Private Key JWT authorization with the Okta JWT Verifier library, and the OIN submission instructions require that method.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [Okta](https://yomu.fyi/topic/okta), [OpenID Connect](https://yomu.fyi/topic/openid-connect)

- Source: [Okta](https://developer.okta.com/blog/2024/04/30/express-universal-logout)
- Source URL: https://developer.okta.com/blog/2024/04/30/express-universal-logout
- Ingested by Yomu: 2026-09-17T14:06:31.140Z

[Read original post](https://developer.okta.com/blog/2024/04/30/express-universal-logout)