diff --git a/src/app/core/facades/account.facade.ts b/src/app/core/facades/account.facade.ts
index ba6fe0c100d..800fad63be1 100644
--- a/src/app/core/facades/account.facade.ts
+++ b/src/app/core/facades/account.facade.ts
@@ -39,6 +39,7 @@ import {
   loadUserPaymentMethods,
   loginUser,
   loginUserWithToken,
+  logoutUser,
   requestPasswordReminder,
   resetPasswordReminder,
   updateCustomer,
@@ -85,6 +86,10 @@ export class AccountFacade {
     this.store.dispatch(loginUserWithToken({ token }));
   }
 
+  logoutUser() {
+    this.store.dispatch(logoutUser());
+  }
+
   createUser(body: CustomerRegistrationType) {
     this.store.dispatch(createUser(body));
   }
diff --git a/src/app/extensions/punchout/pages/punchout/punchout-page.guard.ts b/src/app/extensions/punchout/pages/punchout/punchout-page.guard.ts
index 7647dcd855c..cd2bba4daac 100644
--- a/src/app/extensions/punchout/pages/punchout/punchout-page.guard.ts
+++ b/src/app/extensions/punchout/pages/punchout/punchout-page.guard.ts
@@ -2,11 +2,12 @@ import { isPlatformServer } from '@angular/common';
 import { Inject, Injectable, PLATFORM_ID } from '@angular/core';
 import { ActivatedRouteSnapshot, CanActivate, Router } from '@angular/router';
 import { of, race, throwError } from 'rxjs';
-import { catchError, concatMap, mapTo, switchMap, take, tap } from 'rxjs/operators';
+import { catchError, concatMap, delay, first, mapTo, switchMap, take, tap } from 'rxjs/operators';
 
 import { AccountFacade } from 'ish-core/facades/account.facade';
 import { AppFacade } from 'ish-core/facades/app.facade';
 import { CheckoutFacade } from 'ish-core/facades/checkout.facade';
+import { ApiTokenService } from 'ish-core/utils/api-token/api-token.service';
 import { CookiesService } from 'ish-core/utils/cookies/cookies.service';
 import { whenTruthy } from 'ish-core/utils/operators';
 
@@ -19,6 +20,7 @@ export class PunchoutPageGuard implements CanActivate {
     private appFacade: AppFacade,
     private accountFacade: AccountFacade,
     private checkoutFacade: CheckoutFacade,
+    private apiTokenService: ApiTokenService,
     private cookiesService: CookiesService,
     private punchoutService: PunchoutService,
     @Inject(PLATFORM_ID) private platformId: string
@@ -126,16 +128,27 @@ export class PunchoutPageGuard implements CanActivate {
               return of(this.router.parseUrl('/home'));
             }
           }
-        })
-      )
-    ).pipe(
-      catchError(error =>
-        of(this.router.parseUrl('/error')).pipe(
-          tap(() => {
-            this.appFacade.setBusinessError(error);
-          })
+        }),
+        // punchout error after successful authentication (needs to logout)
+        catchError(error =>
+          this.accountFacade.userLoading$.pipe(
+            first(loading => !loading),
+            delay(0),
+            switchMap(() => {
+              this.accountFacade.logoutUser();
+              this.apiTokenService.removeApiToken();
+              this.appFacade.setBusinessError(error);
+              return of(this.router.parseUrl('/error'));
+            })
+          )
         )
       )
+    ).pipe(
+      // general punchout error handling (parameter missing, authentication error)
+      catchError(error => {
+        this.appFacade.setBusinessError(error);
+        return of(this.router.parseUrl('/error'));
+      })
     );
   }
 }