Logout - AWS Single Sign-On


Removes the locally stored SSO tokens from the client-side cache and sends an API call to the AWS SSO service to invalidate the corresponding server-side AWS SSO sign in session.


If a user uses AWS SSO to access the AWS CLI, the user’s AWS SSO sign in session is used to obtain an IAM session, as specified in the corresponding AWS SSO permission set. More specifically, AWS SSO assumes an IAM role in the target account on behalf of the user, and the corresponding temporary AWS credentials are returned to the client.

After user logout, any existing IAM role sessions that were created by using AWS SSO permission sets continue based on the duration configured in the AWS SSO permission set. For more information, see User authentications in the AWS Single Sign-On User Guide.

Request Syntax

POST /logout HTTP/1.1 x-amz-sso_bearer_token: accessToken

URI Request Parameters

The request uses the following URI parameters.


The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide.

Required: Yes

Request Body

The request does not have a request body.

Response Syntax

HTTP/1.1 200

Response Elements

If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.


For information about the errors that are common to all actions, see Common Errors.


Indicates that a problem occurred with the input to the request. For example, a required parameter might be missing or out of range.

HTTP Status Code: 400


Indicates that the request is being made too frequently and is more than what the server can handle.

HTTP Status Code: 429


Indicates that the request is not authorized. This can happen due to an invalid access token in the request.

HTTP Status Code: 401

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: