# RP-initiated logout - what id token to use as id\_token\_hint?

**URL:** <https://forum.keycloak.org/t/rp-initiated-logout-what-id-token-to-use-as-id-token-hint/15509>\
**Category:** Getting advice\
**Created:** [May 12, 2022, 3:06pm UTC](https://forum.keycloak.org/t/rp-initiated-logout-what-id-token-to-use-as-id-token-hint/15509 "2022-05-12T15:06:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nikel123](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nikel123/32/5145_2.png) [@nikel123](https://forum.keycloak.org/u/nikel123)\
**Post date:** [May 12, 2022, 3:06pm UTC](https://forum.keycloak.org/t/rp-initiated-logout-what-id-token-to-use-as-id-token-hint/15509/1 "2022-05-12T15:06:17Z")

</div>

I can’t get the keycloak to logout in new version with an post logout url. Keycloak tells me “Invalid parameter: id\_token\_hint” regardless if I pass not token, access\_token (Bearer token in my case) or refresh token. Can you tell me what kind of token do I need there? Documentation is a bit unclear about that. So far I understood it, I just need to pass the access token, I got from keycloak with the auth token, but it dind’t work.

---

<div class="post-metadata">

**Author:** ![nikel123](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nikel123/32/5145_2.png) [@nikel123](https://forum.keycloak.org/u/nikel123)\
**Post date:** [May 12, 2022, 4:35pm UTC](https://forum.keycloak.org/t/rp-initiated-logout-what-id-token-to-use-as-id-token-hint/15509/2 "2022-05-12T16:35:26Z")

</div>

Found the solution: one need to do authorization request with scope=“openid”. Then keycloak returns id\_token alongside of acces and refresh tokens from the token endpoint.

---

<div class="post-metadata">

**Author:** ![g34h34h](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/g34h34h/32/6444_2.png) [@g34h34h](https://forum.keycloak.org/u/g34h34h)\
**Post date:** [September 7, 2022, 5:10pm UTC](https://forum.keycloak.org/t/rp-initiated-logout-what-id-token-to-use-as-id-token-hint/15509/3 "2022-09-07T17:10:59Z")

</div>

I don’t think adding `scope=openid` works on Keycloak 18. I have no idea how to get the `id_token` on that version.

---

<div class="post-metadata">

**Author:** ![pratikmuli](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/pratikmuli/32/6620_2.png) [@pratikmuli](https://forum.keycloak.org/u/pratikmuli)\
**Post date:** [December 20, 2022, 10:47am UTC](https://forum.keycloak.org/t/rp-initiated-logout-what-id-token-to-use-as-id-token-hint/15509/4 "2022-12-20T10:47:28Z")

</div>

Adding below mentioned parameter while starting keycloak worked for me:  
“–spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true”  
I am using keycloak 19 (Quarkus) version

---

<div class="post-metadata">

**Author:** ![vincentgong7](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/vincentgong7/32/11796_2.png) [@vincentgong7](https://forum.keycloak.org/u/vincentgong7)\
**Post date:** [December 15, 2024, 1:39am UTC](https://forum.keycloak.org/t/rp-initiated-logout-what-id-token-to-use-as-id-token-hint/15509/5 "2024-12-15T01:39:34Z")

</div>

**Solved** after 3 hours of being stocked with this problem. 😀  
Instead of looking for “id\_token\_hint”, you simply use “ **client\_id** ”.  
Tested on Keycloak version 25.04, on 15 Dec 2024.

The logout URL should be:  
https://{my\_keycloak\_url}/realms/{my\_realm\_name}/protocol/openid-connect/logout?post\_logout\_redirect\_uri=https%3A//myapp\_url& **client\_id** ={ **my\_app\_client\_id\_on\_kk** }