Page updated Nov 3, 2023

Enable sign-out

Invoke the signOut api to sign out a user from the Auth category. You can only have one user signed in at a given time. Calling signOut without any options will delete the local cache and keychain of the user and revoke the token if enabled on Amazon Cognito User Pools. If you would like to sign out of all devices, invoke the signOut api with advanced options.

1Amplify.Auth.signOut( signOutResult -> {
2 if (signOutResult instanceof AWSCognitoAuthSignOutResult.CompleteSignOut) {
3 // Sign Out completed fully and without errors.
4 Log.i("AuthQuickStart", "Signed out successfully");
5 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.PartialSignOut) {
6 // Sign Out completed with some errors. User is signed out of the device.
7 AWSCognitoAuthSignOutResult.PartialSignOut partialSignOutResult =
8 (AWSCognitoAuthSignOutResult.PartialSignOut) signOutResult;
9
10 HostedUIError hostedUIError = partialSignOutResult.getHostedUIError();
11 if (hostedUIError != null) {
12 Log.e("AuthQuickStart", "HostedUI Error", hostedUIError.getException());
13 // Optional: Re-launch hostedUIError.getUrl() in a Custom tab to clear Cognito web session.
14 }
15
16 GlobalSignOutError globalSignOutError = partialSignOutResult.getGlobalSignOutError();
17 if (globalSignOutError != null) {
18 Log.e("AuthQuickStart", "GlobalSignOut Error", globalSignOutError.getException());
19 // Optional: Use escape hatch to retry revocation of globalSignOutError.getAccessToken().
20 }
21
22 RevokeTokenError revokeTokenError = partialSignOutResult.getRevokeTokenError();
23 if (revokeTokenError != null) {
24 Log.e("AuthQuickStart", "RevokeToken Error", revokeTokenError.getException());
25 // Optional: Use escape hatch to retry revocation of revokeTokenError.getRefreshToken().
26 }
27 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.FailedSignOut) {
28 AWSCognitoAuthSignOutResult.FailedSignOut failedSignOutResult =
29 (AWSCognitoAuthSignOutResult.FailedSignOut) signOutResult;
30 // Sign Out failed with an exception, leaving the user signed in.
31 Log.e("AuthQuickStart", "Sign out Failed", failedSignOutResult.getException());
32 }
33});
1Amplify.Auth.signOut { signOutResult ->
2 when(signOutResult) {
3 is AWSCognitoAuthSignOutResult.CompleteSignOut -> {
4 // Sign Out completed fully and without errors.
5 Log.i("AuthQuickStart", "Signed out successfully")
6 }
7 is AWSCognitoAuthSignOutResult.PartialSignOut -> {
8 // Sign Out completed with some errors. User is signed out of the device.
9 signOutResult.hostedUIError?.let {
10 Log.e("AuthQuickStart", "HostedUI Error", it.exception)
11 // Optional: Re-launch it.url in a Custom tab to clear Cognito web session.
12
13 }
14 signOutResult.globalSignOutError?.let {
15 Log.e("AuthQuickStart", "GlobalSignOut Error", it.exception)
16 // Optional: Use escape hatch to retry revocation of it.accessToken.
17 }
18 signOutResult.revokeTokenError?.let {
19 Log.e("AuthQuickStart", "RevokeToken Error", it.exception)
20 // Optional: Use escape hatch to retry revocation of it.refreshToken.
21 }
22 }
23 is AWSCognitoAuthSignOutResult.FailedSignOut -> {
24 // Sign Out failed with an exception, leaving the user signed in.
25 Log.e("AuthQuickStart", "Sign out Failed", signOutResult.exception)
26 }
27 }
28}
1val signOutResult = Amplify.Auth.signOut()
2when(signOutResult) {
3 is AWSCognitoAuthSignOutResult.CompleteSignOut -> {
4 // Sign Out completed fully and without errors.
5 Log.i("AuthQuickStart", "Signed out successfully")
6 }
7 is AWSCognitoAuthSignOutResult.PartialSignOut -> {
8 // Sign Out completed with some errors. User is signed out of the device.
9 signOutResult.hostedUIError?.let {
10 Log.e("AuthQuickStart", "HostedUI Error", it.exception)
11 // Optional: Re-launch it.url in a Custom tab to clear Cognito web session.
12
13 }
14 signOutResult.globalSignOutError?.let {
15 Log.e("AuthQuickStart", "GlobalSignOut Error", it.exception)
16 // Optional: Use escape hatch to retry revocation of it.accessToken.
17 }
18 signOutResult.revokeTokenError?.let {
19 Log.e("AuthQuickStart", "RevokeToken Error", it.exception)
20 // Optional: Use escape hatch to retry revocation of it.refreshToken.
21 }
22 }
23 is AWSCognitoAuthSignOutResult.FailedSignOut -> {
24 // Sign Out failed with an exception, leaving the user signed in.
25 Log.e("AuthQuickStart", "Sign out Failed", signOutResult.exception)
26 }
27}
1RxAmplify.Auth.signOut()
2 .subscribe(signOutResult -> {
3 if (signOutResult instanceof AWSCognitoAuthSignOutResult.CompleteSignOut) {
4 // Sign Out completed fully and without errors.
5 Log.i("AuthQuickStart", "Signed out successfully");
6 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.PartialSignOut) {
7 // Sign Out completed with some errors. User is signed out of the device.
8 AWSCognitoAuthSignOutResult.PartialSignOut partialSignOutResult =
9 (AWSCognitoAuthSignOutResult.PartialSignOut) signOutResult;
10
11 HostedUIError hostedUIError = partialSignOutResult.getHostedUIError();
12 if (hostedUIError != null) {
13 Log.e("AuthQuickStart", "HostedUI Error", hostedUIError.getException());
14 // Optional: Re-launch hostedUIError.getUrl() in a Custom tab to clear Cognito web session.
15 }
16
17 GlobalSignOutError globalSignOutError = partialSignOutResult.getGlobalSignOutError();
18 if (globalSignOutError != null) {
19 Log.e("AuthQuickStart", "GlobalSignOut Error", globalSignOutError.getException());
20 // Optional: Use escape hatch to retry revocation of globalSignOutError.getAccessToken().
21 }
22
23 RevokeTokenError revokeTokenError = partialSignOutResult.getRevokeTokenError();
24 if (revokeTokenError != null) {
25 Log.e("AuthQuickStart", "RevokeToken Error", revokeTokenError.getException());
26 // Optional: Use escape hatch to retry revocation of revokeTokenError.getRefreshToken().
27 }
28 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.FailedSignOut) {
29 AWSCognitoAuthSignOutResult.FailedSignOut failedSignOutResult =
30 (AWSCognitoAuthSignOutResult.FailedSignOut) signOutResult;
31 // Sign Out failed with an exception, leaving the user signed in.
32 Log.e("AuthQuickStart", "Sign out Failed", failedSignOutResult.getException());
33 }
34 });

Sign Out Result Types

CompleteSignOut

Indicates a successful sign out with no errors.

PartialSignOut

Indicates that sign out was completed, but with errors. The device credentials have been cleared and the user is locally signed out of the device. The PartialSignOut class will return 1 or more errors where sign out actions can be retried manually.

  • GlobalSignOutError - The GlobalSignOut action failed.
    • error: A GlobalSignOutException that provides a message and recovery suggestion for the failure.
    • accessToken: The access token that was unable to be revoked. The Escape Hatch can be used to manually retry the global sign out.
  • RevokeTokenError - The RevokeToken action failed.
    • error: A RevokeTokenException that provides a message and recovery suggestion for the failure.
    • refreshToken: The refresh token that was unable to be revoked. The Escape Hatch can be used to manually retry revoking the token.
  • HostedUIError - The HostedUI sign out action failed.
    • error: A HostedUISignOutException that provides a message and recovery suggestion for the failure.
    • url: The url that was used to attempt the Cognito web session sign out in the CustomTab.

FailedSignOut

Indicates a failed sign out where user credentials remain on the device. See the attached AuthException to determine the cause. The most likely exception is a UserCancelledException where the user cancelled a HostedUI Sign Out before the redirect was received.

Token Revocation

Amazon Cognito now supports token revocation. This means that the Cognito refresh token cannot be used anymore to generate new Access and Id Tokens.

Access and Id Tokens are short-lived (60 minutes by default but can be set from 5 minutes to 1 day). After revocation, these tokens cannot be used with Cognito User Pools anymore. However, they are still valid when used with other services like AppSync or API Gateway.

For limiting subsequent calls to these other services after invalidating tokens, we recommend lowering token expiration time for your app client in the Cognito User Pools console. If you are using the Amplify CLI this can be accessed by running amplify console auth.

Token revocation is enabled automatically on new Amazon Cognito User Pools, however existing User Pools must enable this feature, using the Cognito Console or AWS CLI.

Global Sign Out

Calling signout with globalSignOut = true will invalidate all the Cognito User Pool tokens of the signed in user. If the user is signed into a device, they won't be authorized to perform a task that requires a valid token when a global signout is called from some other device. They need to sign in again to get valid tokens.

1AuthSignOutOptions options = AuthSignOutOptions.builder()
2 .globalSignOut(true)
3 .build();
4
5Amplify.Auth.signOut(options, signOutResult -> {
6 if (signOutResult instanceof AWSCognitoAuthSignOutResult.CompleteSignOut) {
7 // handle successful sign out
8 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.PartialSignOut) {
9 // handle partial sign out
10 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.FailedSignOut) {
11 // handle failed sign out
12 }
13});
1val options = AuthSignOutOptions.builder()
2 .globalSignOut(true)
3 .build()
4
5Amplify.Auth.signOut(options) { signOutResult ->
6 when(signOutResult) {
7 is AWSCognitoAuthSignOutResult.CompleteSignOut -> {
8 // handle successful sign out
9 }
10 is AWSCognitoAuthSignOutResult.PartialSignOut -> {
11 // handle partial sign out
12 }
13 is AWSCognitoAuthSignOutResult.FailedSignOut -> {
14 // handle failed sign out
15 }
16 }
17}
1val options = AuthSignOutOptions.builder()
2 .globalSignOut(true)
3 .build()
4
5val signOutResult = Amplify.Auth.signOut(options)
6
7when(signOutResult) {
8 is AWSCognitoAuthSignOutResult.CompleteSignOut -> {
9 // handle successful sign out
10 }
11 is AWSCognitoAuthSignOutResult.PartialSignOut -> {
12 // handle partial sign out
13 }
14 is AWSCognitoAuthSignOutResult.FailedSignOut -> {
15 // handle failed sign out
16 }
17}
1AuthSignOutOptions options = AuthSignOutOptions.builder()
2 .globalSignOut(true)
3 .build();
4
5RxAmplify.Auth.signOut(options)
6 .subscribe(signOutResult -> {
7 if (signOutResult instanceof AWSCognitoAuthSignOutResult.CompleteSignOut) {
8 // handle successful sign out
9 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.PartialSignOut) {
10 // handle partial sign out
11 } else if (signOutResult instanceof AWSCognitoAuthSignOutResult.FailedSignOut) {
12 // handle failed sign out
13 }
14 });