---
title: "Revoke Token"
method: POST
path: "/oauth/revoke"
tags: ["OAuth"]
---

# Revoke Token

`POST /oauth/revoke`

RFC 7009 token revocation. Revocation applies only to the submitted token: revoking a refresh token does not revoke related access tokens, so callers must revoke both tokens to end both credentials. Public clients send client_id. Confidential clients authenticate with client_id and client_secret in the form body (client_secret_post). For a valid client and well-formed request, returns 200 even if the token is unknown, to prevent token enumeration.

## Response `200`

Empty body (RFC 7009)

## Other responses

- `400` — Default Response
- `401` — invalid_client

---

[API](https://skmtc.net/bkeyid/apis/bkey-api.md) · [All operations](https://skmtc.net/bkeyid/apis/bkey-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bkeyid/bkey-api/revisions/304d4d4d93c7/schema)