POST revoke

Revoke a token

Revokes an access or refresh token. Returns HTTP 200 with an empty JSON object even when the token is unknown. Confidential clients must authenticate (for example client_id and client_secret in the body or HTTP Basic authentication).

post/revoke

Request body

tokenstring required

Access token or refresh token to revoke.

token_type_hint'access_token' | 'refresh_token'

Optional hint which token type is supplied.

client_idstring

client_secretstring

Required for confidential clients (or use HTTP Basic authentication).

Response

Token revoked, or token unknown / already invalid (empty object).

object required