---
title: "Revoke all app tokens"
method: POST
path: "/oauth-clients/{appId}/revoke-all-tokens"
tags: ["OAuth Apps"]
---

# Revoke all app tokens

`POST /oauth-clients/{appId}/revoke-all-tokens`

Revokes every access and refresh token currently issued to an OAuth app, in a single operation. Use this for emergency credential rotation, suspected secret leaks, or as a follow-up to `POST /oauth-clients/{appId}/regenerate-secret` when you want existing sessions invalidated immediately rather than letting them expire naturally.

The response `count` is the total number of tokens revoked across both types. Clients of this app must then obtain new tokens via the standard OAuth flow.

Creator-only.

## Path parameters

- `appId` string, required

## Response `200`

All tokens revoked

- object
  - `message` string
  - `count` integer — Number of tokens revoked

## Other responses

- `401` — Unauthorized
- `403` — Forbidden — caller cannot access this OAuth app (creator-only; see OAuth Apps tag).
- `404` — OAuth app not found or not visible to this caller (each user only sees apps they created)
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/revisions/64bfe76b130e/schema)