Skip to main content
If you embed the promoter dashboard and auto-login promoters, you’ll also want a way to end that session — either because the promoter logged out of your app, or because you want to immediately cut off a specific promoter’s access instead of waiting for their token to expire. There are two independent ways a promoter’s embedded session ends:

Self-service logout

The promoter clicks Log out inside the embedded dashboard itself. No API call needed — this happens automatically.

Targeted logout (your backend)

Your backend calls iframe_logout for a specific promoter, revoking their access immediately — for example when the corresponding user logs out of your app.

​
Self-service logout

When a promoter clicks Log out from the account menu inside the embedded dashboard, FirstPromoter invalidates that session’s token and returns them to a signed-out state within the iframe. This requires no setup and no API call on your side — it’s built into the dashboard.
This only ends the current session token. If your app issues a fresh token on every page load (as recommended in the login guide), reloading the page after this will silently log the promoter back in. If you want the logout to stick, pair it with the targeted logout below, triggered from your own app’s logout flow.

​
Targeted logout (from your backend)

Call this whenever you want to end a specific promoter’s embedded session from your side — typically when that user logs out of your app, or when you need to immediately revoke their access (e.g. they were suspended). It targets one promoter at a time by promoter_id or cust_id, so it never affects any other promoter’s session.
​
integer
The FirstPromoter promoter ID whose session to end. Provide this or cust_id.
​
string
The external customer ID you assigned this promoter. Provide this or promoter_id.
​
string
required
Bearer {your_api_key}
​
string
required
{your_account_id}
The request body is empty. A 200 OK with no body confirms the session was revoked; a 404 means no promoter matched the promoter_id/cust_id you passed.
This revokes every currently active access token that promoter has under your account — including any not-yet-expired tokens from earlier iframe_login calls (e.g. from other tabs or an earlier page load). It does not touch that same person’s sessions under any other FirstPromoter account they may also be a promoter for.

​
Example

​
When to call this

  • On your app’s own logout action — call it alongside your normal sign-out logic so the dashboard doesn’t silently re-authenticate on the next page load.
  • When suspending or deactivating a user — revoke dashboard access immediately rather than waiting up to 24 hours for their last token to expire.
  • Before switching which promoter is shown in the same embedded iframe — e.g. an admin view of your app that lets staff preview different promoters’ dashboards.