Log Out Multiple Shoppers

Starting with B2C Commerce version 26.9, use the batchLogout endpoint of the Shopper Login and API Access Service (SLAS) Admin API to log out up to 50 shoppers across all their sessions. Identify each shopper by their login ID and authenticate the request with a SLAS admin token or an Account Manager access token with the appropriate permissions.

For example, use this endpoint to:

Invalidate every session for shopper accounts affected by a security incident.
Force reauthentication for a group of shoppers as part of an account-security or support workflow.

For a shopper-initiated logout, use the logoutCustomer endpoint instead. That endpoint revokes the access token and the refresh token supplied by the shopper’s session. Batch logout is an administrative operation and affects every session associated with each successful login ID.

Understand the Logout Behavior

For each valid login ID, SLAS revokes all active refresh tokens and inactivates all active access tokens issued before the request. The shopper must then authenticate again using their configured login method. Batch logout doesn’t change the shopper’s password or other account credentials.

Send a Batch Logout Request

Authorize the Request

Authenticate the request with a SLAS admin token or Account Manager access token.

For manual requests or testing, get a SLAS admin token from the SLAS Admin UI. Your Account Manager user must have the SLAS Organization Administrator role and the correct instance filters.
For automated integrations, configure an Account Manager API client with the Salesforce Commerce API role for the target instance and use the client’s credentials to request an access token.

Send the Request

Gather the access token, the short code, the tenant ID, and the site ID for the B2C Commerce instance. See Base URL and Request Formation.

Send up to 50 shopper login IDs in the loginIds array.

1curl "https://{SHORT_CODE}.api.commercecloud.salesforce.com/shopper/auth-admin/v1/tenants/{TENANT_ID}/batch-logout?channelId={SITE_ID}" \
2--request 'POST' \
3--header 'Content-Type: application/json' \
4--header "Authorization: Bearer {ACCESS_TOKEN}" \
5--data-raw '{
6  "loginIds": [
7    "user1@example.com",
8    "user2@example.com"
9  ]
10}'

A syntactically valid request returns 200 OK even when SLAS can’t log out one or more shoppers. Check each entry in the results array instead of relying on the HTTP status alone. A login ID that doesn’t match a shopper returns a failure status. Duplicate login IDs return a not_processed status.