Log Out Multiple Shoppers

Starting with B2C Commerce version 26.9, use the batchLogout endpoint of the Shopper Login and API Access Service (SLAS) Admin API to log out up to 50 shoppers across all their sessions. Identify each shopper by their login ID and authenticate the request with a SLAS admin token or an Account Manager access token with the appropriate permissions. The batchLogout endpoint is not currently supported for third party identity provider (IDP) workflows.

For example, use this endpoint to:

Invalidate every session for shopper accounts affected by a security incident.
Force reauthentication for a group of shoppers as part of an account-security or support workflow.

For a shopper-initiated logout, use the logoutCustomer endpoint instead. That endpoint revokes the access token and the refresh token supplied by the shopper’s session. Batch logout is an administrative operation and affects every session associated with each successful login ID.

Understand the Logout Behavior

For each valid login ID, SLAS revokes all active refresh tokens and inactivates all active access tokens issued before the request. The shopper must then authenticate again using their configured login method. Batch logout doesn’t change the shopper’s password or other account credentials.

Send a Batch Logout Request

Authorize the Request

Authenticate the request with a SLAS admin token or Account Manager access token.

For manual requests or testing, get a SLAS admin token from the SLAS Admin UI. Your Account Manager user must have the SLAS Organization Administrator role and the correct instance filters.
For automated integrations, configure an Account Manager API client with the Salesforce Commerce API and Sandbox API User roles for the target instance, and use the client’s credentials to request an access token.

Send the Request

Gather the access token, the short code, the tenant ID, and the site ID for the B2C Commerce instance. See Base URL and Request Formation.

Send up to 50 shopper login IDs in the loginIds array. Login IDs are case-insensitive.

By default, SLAS looks up each login ID among shoppers who authenticate with B2C Commerce credentials. Starting with B2C Commerce version 26.10, to log out shoppers who authenticate through a third-party identity provider (IDP), add the optional idp_origin query parameter. Set it to the IDP name exactly as it was entered when the IDP was created in SLAS, including letter case. The value can be up to 200 characters, and SLAS applies it to every login ID in the request. If you omit idp_origin or leave it blank, SLAS uses ecom.

1curl "https://{SHORT_CODE}.api.commercecloud.salesforce.com/shopper/auth-admin/v1/tenants/{TENANT_ID}/batch-logout?channelId={SITE_ID}" \
2--request 'POST' \
3--header 'Content-Type: application/json' \
4--header "Authorization: Bearer {ACCESS_TOKEN}" \
5--data-raw '{
6  "loginIds": [
7    "user1@example.com",
8    "user2@example.com"
9  ]
10}'

This example logs out shoppers who authenticate through an IDP named okta.

1curl "https://{SHORT_CODE}.api.commercecloud.salesforce.com/shopper/auth-admin/v1/tenants/{TENANT_ID}/batch-logout?channelId={SITE_ID}&idp_origin=okta" \
2--request 'POST' \
3--header 'Content-Type: application/json' \
4--header "Authorization: Bearer {ACCESS_TOKEN}" \
5--data-raw '{
6  "loginIds": [
7    "user3@example.com",
8    "user4@example.com"
9  ]
10}'

To log out shoppers who authenticate through different IDPs, send a separate request for each IDP.

A syntactically valid request returns 200 OK even when SLAS can’t log out one or more shoppers. Check each entry in the results array instead of relying on the HTTP status alone. A login ID that doesn’t match a shopper returns a failure status. Duplicate login IDs return a not_processed status.