Sign in

v10

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-0582185581.9 KB
OAuth Provider

Revoke an access or refresh token

OAuth 2.0 Token Revocation Endpoint (RFC 7009).

Revokes an access token or refresh token, preventing further use. Revoking a refresh token also invalidates associated access tokens.

Use Cases:

  • User logs out of third-party app
  • User revokes app access from account settings
  • Security incident response

Note: Returns 200 OK even if token was already revoked or invalid (per RFC 7009, to prevent token enumeration).

post/oauth2/revoke

Request body

tokenstring required

The token to revoke

token_type_hint'access_token' | 'refresh_token'

Hint about token type (optional, improves performance)

client_idstring required

Client ID

client_secretstring

Client secret

Response

Token revoked (or was already invalid)