1) I dont want to use /secur/logout.jsp as it will log me out from all the active salesforce sessions.
2) I also dont want to use prompt=login, because if an user has a parallel active session, I want the app to use that session to log in the user automatically.
Update: 3) I also tried revoking the access token, after which when I try to login, the previous user is automatically logged in without asking for the credentials.

I am developing a connected app in salesforce that allows users to login through salesforce credentials(using salesforce/services/authorize). However I am unable to find a way to log the user out or end that particular session.

Can someone please help me out on this?

  • Are you looking for some specific response? Answer is provided in exact same question already. Thinking to close this as it is duplicate then. – Ashwani Jul 18 '16 at 23:32
  • No, just provided a shorter version of the same question, for some users who might not be interested to read the lengthy question. – Rakesh D Jul 19 '16 at 8:02

I would assume that you would revoke the current token that has been granted based on following the OAuth flow with the connected app.

If you review Revoking OAuth 2.0 Access Tokens and Refresh Tokens document, you'll see you can do the following:


Hopefully this helps out!

| improve this answer | |
  • Hi, I tried that but that is only revoking the access token. Next time I try to login, the user is automatically logged in without asking for credentials though there are no other active sessions. – Rakesh D Jul 19 '16 at 7:51
  • You are most likely logging them in again using the refresh token. You need to expire both the active token and the refresh token. – techbusinessman Jul 19 '16 at 19:53
  • Both the access token and refresh tokens are revoked. But when the user tries to log in, it doesnt ask for credentials. It directly logs in the user. How do I avoid this? How to revoke the authorization? – Rakesh D Jul 21 '16 at 21:21
  • If it's still passing through after revoking the tokens, you are automatically logging them in your code process flow. The revoke button that you see on a connected app is doing the same thing as revoking the tokens. – techbusinessman Jul 21 '16 at 21:25
  • I also destroy the current session while revoking access and refresh tokens. Even that doesnt seem to work. How exactly should I make the user enter his credentials? There is prompt=login parameter that can be added to the authorize url if the credentials are required every time. But in that case, suppose if there is an active salesforce session it doesnt log in the user directly. So in all my question is how do I actually destroy the authentication session when the user press logout? – Rakesh D Jul 21 '16 at 21:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.