---
title: "Revoke Access Token"
method: POST
path: "/api/{serviceId}/auth/token/revoke"
tags: ["Token Operations"]
---

# Revoke Access Token

`POST /api/{serviceId}/auth/token/revoke`

Revoke an access token.

## Path parameters

- `serviceId` string, required

## Request body

- TokenRevokeRequest
  - `accessTokenIdentifier` string — The identifier of an access token to revoke The hash of an access token is recognized as an identifier as well as the access token itself.
  - `refreshTokenIdentifier` string — The identifier of a refresh token to revoke. The hash of a refresh token is recognized as an identifier as well as the refresh token itself.
  - `clientIdentifier` string — The client ID of the access token to be revoked. Both the numeric client ID and the alias are recognized as an identifier of a client. Bulk revocation with `clientIdentifier` only or `clientIdentifier` + `subject` deletes at most **20 tokens per request** (the default of `token.revoke.count.max` in `ServerConfiguration.java`). If the target has more than 20 tokens, the response `count` will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until `count` returns 0.
  - `subject` string — The subject of a resource owner. Bulk revocation with `clientIdentifier` + `subject` or `subject` only deletes at most **20 tokens per request** (the default of `token.revoke.count.max` in `ServerConfiguration.java`). If the target has more than 20 tokens, the response `count` will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until `count` returns 0.

## Response `200`

Token revoked successfully

- TokenRevokeResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `count` integer — The number of tokens revoked. If the target has more than 20 tokens, the response `count` will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until `count` returns 0.

## Other responses

- `400`
- `401`
- `403`
- `404`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

---

[API](https://skmtc.net/authlete/apis/authlete-api.md) · [All operations](https://skmtc.net/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authlete/authlete-api/versions/7ad74ab64749/schema)