Revoke an existing OAuth2 access token

Our implementation follows the proposed IETF specification RFC-7009.

If your client application offers the ability to for a logged-in user to log out, and you have access to a long-lived client_credentials token (i.e. you have generated one that you are storing securely for the lifetime of the entire app install), we suggest (but do not require) that you call this endpoint and revoke the access token belonging to the logged-in user as part of your logout process. If you do not already have a long-lived client_credentials token, please don't generate one just for the purposes of calling this endpoint.

If you are building a prototype application, we also recommend that you use this endpoint to clean up access tokens that you generate during the testing of your app and do not intend to reuse.

Note that revoking an access token will automatically revoke any refresh tokens associated with it, and vice-versa.