# Is there a way to force a mass logout?

**URL:** https://meta.discourse.org/t/is-there-a-way-to-force-a-mass-logout/28862
**Category:** Support
**Created:** [Maio 15, 2015, 2:33pm UTC](https://meta.discourse.org/t/is-there-a-way-to-force-a-mass-logout/28862 "2015-05-15T14:33:19Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Juan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/juan/32/103227_2.png) [@Juan](https://meta.discourse.org/u/Juan)
#### Post date: [Maio 15, 2015, 2:33pm UTC](https://meta.discourse.org/t/is-there-a-way-to-force-a-mass-logout/28862/1 "2015-05-15T14:33:19Z")

</div>

I recently updated my internal instance to use SSO, and I want to force all users to re-login to validate their accounts against the other system.

Can I force every user to logout or is the only way to do it one by one?

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [Maio 16, 2015, 12:43am UTC](https://meta.discourse.org/t/is-there-a-way-to-force-a-mass-logout/28862/3 "2015-05-16T00:43:08Z")

</div>

```plaintext
./launcher enter app
rails c
UserAuthToken.destroy_all

```

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [Outubro 13, 2017, 10:30pm UTC](https://meta.discourse.org/t/is-there-a-way-to-force-a-mass-logout/28862/8 "2017-10-13T22:30:57Z")

</div>

Any comments here @sam? This would also be duplicated on the “my Discourse was compromised” topic.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [Outubro 13, 2017, 10:34pm UTC](https://meta.discourse.org/t/is-there-a-way-to-force-a-mass-logout/28862/9 "2017-10-13T22:34:47Z")

</div>

`UserAuthToken.destroy_all` would do the trick, you also would want to revoke api keys so that is 2 additional tables to nuke, `ApiKey` and `UserApiKey`.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [Março 6, 2018, 6:32am UTC](https://meta.discourse.org/t/is-there-a-way-to-force-a-mass-logout/28862/14 "2018-03-06T06:32:30Z")

</div>