---
title: "Revoke an access or refresh token"
method: POST
path: "/oauth2/revoke"
tags: ["OAuth Provider"]
---

# Revoke an access or refresh token

`POST /oauth2/revoke`

OAuth 2.0 Token Revocation Endpoint (RFC 7009).

Revokes an access token or refresh token, preventing further use.
Revoking a refresh token also invalidates associated access tokens.

**Use Cases:**
- User logs out of third-party app
- User revokes app access from account settings
- Security incident response

**Note:** Returns 200 OK even if token was already revoked or invalid
(per RFC 7009, to prevent token enumeration).

## Request body

- OAuthRevokeRequest — OAuth 2.0 Token Revocation Request (RFC 7009). Revokes an access or refresh token.
  - `token` string, required — The token to revoke
  - `token_type_hint` 'access_token' | 'refresh_token' — Hint about token type (optional, improves performance)
  - `client_id` string, required — Client ID
  - `client_secret` string — Client secret

## Response `200`

Token revoked (or was already invalid)

## Other responses

- `401` — Client authentication failed
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/versions/abd27cfefc73/schema)