Revoke an access token or a refresh token.

If you revoke a refresh token, be aware that:

• The refresh token's lineage is also revoked. This means that access tokens created from that refresh token are also revoked.
• The user's consent for your integration is also revoked. This means that the user must go through the OAuth process again to use your integration.

Requests to this endpoint require authentication with your client ID and client secret, using one of the following methods:

• Basic access authentication (Recommended): For basic access authentication, the {credentials} string must be a Base64 encoded value of {client id}:{client secret}.
• Body parameters: Provide your integration's credentials using the client_id and client_secret body parameters.

This endpoint can't be called from a user's web-browser client because it uses client authentication with client secrets. Requests must come from your integration's backend, otherwise they'll be blocked by Canva's Cross-Origin Resource Sharing (CORS) policy.