Revoke OAuth 2.0 Access or Refresh Token

Revokes an OAuth 2.0 access or refresh token so it can no longer be used. Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by the client it was generated for.

Authenticate confidential clients with HTTP Basic authentication. Clients configured for form-body authentication may instead include both client_id and client_secret in the request body.

application/x-www-form-urlencoded

Request Body required

client_id string

The client identifier. Include this when client credentials are not sent using HTTP Basic authentication.

client_secret string

The client secret. Include this for confidential clients when credentials are not sent using HTTP Basic authentication.

token string required

The OAuth 2.0 access token or refresh token to revoke.

Responses

Token revoked successfully. The response body is empty.

Bad request

application/json

Schema

Example (from schema)

invalid_request

Schema

error string

Error code

error_debug string

Error Debug Information

Only available in dev mode.

error_description string

Human-readable ASCII text providing additional information about the error

error_hint string

Error Hint

Helps the user identify the error cause.

status_code int64

HTTP Status Code

{
  "error": "invalid_client",
  "error_debug": "string",
  "error_description": "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The requested OAuth 2.0 Client does not exist.",
  "error_hint": "The redirect URL is not allowed.",
  "status_code": 401
}

Token parameter is missing or malformed

{
  "error": "invalid_request",
  "error_description": "The token parameter is required.",
  "status_code": 400
}

Unauthorized - invalid client credentials