Revoke a token (RFC 7009)

POST

/api/oauth/revoke

A refresh token revokes the whole authorization; an access token only itself. Always 200 for a valid client.

App integration: Use on disconnect with the relevant OAuth token and registered client authentication. Revoking a refresh token ends its entire authorization; revoking an access token ends that token. An empty 200 also covers already-invalid tokens. Clear your local cached user data and credentials according to the disconnect action.

Request

Authorization

Basic Auth

Send your HTTP requests with an

Authorization

header that contains the word Basic followed by a space and a base64-encoded string username:password

Example:

Authorization: Basic *****************

Body Params application/x-www-form-urlencodedRequired

Responses

🟢200

Revoked (or already dead).

Headers

This response does not have a body.

🟠400

🟠401

🟠429

Request Example

Shell

JavaScript

Java

Swift

curl --location '/api/oauth/revoke' \
--header 'Authorization: Basic <encoded-value>' \
--data-urlencode 'token=' \
--data-urlencode 'token_type_hint=' \
--data-urlencode 'client_id=' \
--data-urlencode 'client_secret='

Response Example

400 - Example 1

{
    "error": "invalid_request",
    "error_description": "string"
}

Modified at 2026-10-26 12:58:15

Exchange a code, or refresh

Live document socket — README