---
title: "POST /v1/oauth/revoke"
method: POST
path: "/v1/oauth/revoke"
tags: ["oauth"]
---

# POST /v1/oauth/revoke

`POST /v1/oauth/revoke`

Revoke an access token or a refresh token.

If you revoke a _refresh token_, be aware that:

- The refresh token's lineage is also revoked. This means that access tokens created from that refresh token are also revoked.
- The user's consent for your integration is also revoked. This means that the user must go through the OAuth process again to use your integration.

Requests to this endpoint require authentication with your client ID and client secret, using _one_ of the following methods:

- **Basic access authentication** (Recommended): For [basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication), the `{credentials}` string must be a Base64 encoded value of `{client id}:{client secret}`.
- **Body parameters**: Provide your integration's credentials using the `client_id` and `client_secret` body parameters.

This endpoint can't be called from a user's web-browser client because it uses client authentication with client secrets. Requests must come from your integration's backend, otherwise they'll be blocked by Canva's [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) policy.

## Response `200`

OK

- RevokeTokensResponse — The response on a successful token revocation.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `default` — Error Response

---

[API](https://skmtc.net/canva/apis/canva-connect-api.md) · [All operations](https://skmtc.net/canva/apis/canva-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/canva/canva-connect-api/versions/499c392c7720/schema)