Skip to main content
If you embed the promoter dashboard and auto-login promoters, you’ll also want a way to end that session — either because the promoter logged out of your app, or because you want to immediately cut off a specific promoter’s access instead of waiting for their token to expire. There are two independent ways a promoter’s embedded session ends:

Self-service logout

The promoter clicks Log out inside the embedded dashboard itself. No API call needed — this happens automatically.

Targeted logout (your backend)

Your backend calls iframe_logout for a specific promoter, revoking their access immediately — for example when the corresponding user logs out of your app.

​
Self-service logout

When a promoter clicks Log out from the account menu inside the embedded dashboard, FirstPromoter revokes every active session that promoter currently has under your account — not just the tab or page they clicked logout from — and returns them to a signed-out state within the iframe. This requires no setup and no API call on your side — it’s built into the dashboard.
Because every session is revoked, this also signs the promoter out of any other tab where you’ve embedded their dashboard. If your app issues a fresh token on every page load (as recommended in the login guide), reloading the page after this will silently log the promoter back in. If you want the logout to stick, pair it with the targeted logout below, triggered from your own app’s logout flow.

​
Targeted logout (from your backend)

Call this whenever you want to end a specific promoter’s embedded session from your side — typically when that user logs out of your app, or when you need to immediately revoke their access (e.g. they were suspended). It targets one promoter at a time by promoter_id or cust_id, so it never affects any other promoter’s session.
​
integer
The FirstPromoter promoter ID whose session to end. Provide this or cust_id.
​
string
The external customer ID you assigned this promoter. Provide this or promoter_id.
​
string
Optional. The access_token value returned by a specific iframe_login call. Pass this to revoke only that one session instead of every active session — see Ending a single session below. If provided, this takes priority over promoter_id/cust_id; if left blank, the request falls back to revoking all of the promoter’s sessions.
​
string
required
Bearer {your_api_key}
​
string
required
{your_account_id}
The request body is empty. A 200 OK with no body confirms the session was revoked; a 404 means no promoter matched the promoter_id/cust_id you passed (or, when using session_token, that the token doesn’t exist, is already revoked, belongs to a different account, or doesn’t belong to a promoter).
Without session_token, this revokes every currently active access token that promoter has under your account — including any not-yet-expired tokens from earlier iframe_login calls (e.g. from other tabs or an earlier page load). It does not touch that same person’s sessions under any other FirstPromoter account they may also be a promoter for.

​
Ending a single session

If you embed the dashboard in multiple places at once for the same promoter (e.g. several open tabs, or a mobile and web session) and only want to end one of them, pass session_token instead of promoter_id/cust_id. Its value is the access_token your backend received from the corresponding iframe_login call — so you’ll need to have stored that value per-session in order to target it later.
cURL
All of the promoter’s other active sessions remain untouched.

​
Example

​
When to call this

  • On your app’s own logout action — call it alongside your normal sign-out logic so the dashboard doesn’t silently re-authenticate on the next page load.
  • When suspending or deactivating a user — revoke dashboard access immediately rather than waiting up to 24 hours for their last token to expire.
  • Before switching which promoter is shown in the same embedded iframe — e.g. an admin view of your app that lets staff preview different promoters’ dashboards.