I need to create a logout button in my app, and I do not know how to revoke simple_oauth tokens programmatically, but I have noticed if the user saves their profile form (form_id: "user_form") in Drupal, it revokes the user's access token.

So I'm wondering if there is a way to programmatically submit the form so I can do so in a logout endpoint for my app.

That is, unless someone can point me to the specific code that revokes a user's access token when the user edit form is saved, so I can fire that hook more directly.

Because the oauth2_token table does not reference the associated user (auth_user_id is always zero), I don't know how to look up a token by UID for the purpose of revoking the token. Thus, even though it seems like a hack, the only thing I can think to do is to try to submit the user edit form programmatically.

UPDATE: I was wrong about "auth_user_id is always zero". See my answer below.

3 Answers 3


I was mistaken when I said "auth_user_id" is always zero. It isn't. It contains the user's ID, as you would expect. That makes this task fairly simple. Here is the function for my logout endpoint:

public function logout($name = NULL) {

    if ($name) {
      $user = user_load_by_name($name);
      if ($user) {
        $uid = $user->id();

        $msg = 'User ' . $name . ' (uid: ' . $uid . ') logged out of app.';

        // Not sure if it would be a better practice to set the status to zero, or delete.  In this example I delete the row.     
        $query = \Drupal::database()->delete('oauth2_token');
        $query->condition('auth_user_id', $uid);

    $response['data'] = [];
    $response['method'] = 'POST';

    return new JsonResponse($response);

In my routing file I have...

  path: '/orb_common/logout/{name}'
    _controller: '\Drupal\orb_common\Controller\CommonController::logout'
    _title: 'Logout'
    _permission: 'edit activity entities'

The JsonResponse at the end of my logout function presumably isn't important in this case. The main thing is to pass a UID or username to Drupal in the URL of the endpoint, and then delete/update the relevant row in the oauth2_token table. At least, that is working in my app.


Logging the user out through Drupal itself should revoke the user's access token.

Try invoking UserController::logout.

  • 1
    This method calls user_logout(), which ends a Drupal session but has no impact on simple_oauth tokens. I need to revoke the simple_oauth token for the user.
    – arnoldbird
    May 8, 2018 at 18:33
  • I apologize. I misunderstood. This seems to be a known issue with the module. Source: #2945273 May 8, 2018 at 19:32
  • 1
    No worries. I'm a participant in that issue, as it happens.
    – arnoldbird
    May 9, 2018 at 17:54

You dont need to submit the form programmatically, all you need to do is to call user_logout() in your logout API endpoint. This should invalidate all the session tokens.

FYI you should check the Drupal 8 REST API docs, there is a core endpoint for logging out current user. Check this URL below,


  • The user_logout() function has no effect on simple_oauth access tokens, so I'm afraid this doesn't work. The user_logout() function is a way to end Drupal browser sessions.
    – arnoldbird
    May 8, 2018 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.