Skip to content

id_token_hint_invalid

Returned as
The problem's code
HTTP status
400 Bad Request
type
https://zautha.com/docs/errors/id_token_hint_invalid

/oauth/end_session needs an id_token_hint issued for the browser’s current session. The hint is missing, is not one of this instance’s ID tokens, or is for another session; or the browser has no session there. On a production instance, a cross-site POST to /oauth/end_session does not carry the session cookie (it is SameSite=Lax), so it gets this error: send the user there with a GET redirect instead.

Redirect the browser to /oauth/end_session with the ID token you got for this session.