POST
/revoke
Revoke
Summary
OAuth 2.0 token revocation endpoint advertised in discovery as revocation_endpoint. Call this to invalidate refresh (and access) tokens when the user signs out of the app.
Auth
Same client authentication as /token (client_secret_post or none).
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
token |
body | yes | string | Access or refresh token to revoke. |
token_type_hint |
body | no | string | Optional: access_token or refresh_token. |
client_id |
body | yes | string | Registered client identifier. |
client_secret |
body | no | string | Required unless the client uses auth method none. |
Example request
POST /revoke HTTP/1.1
Host: <issuer-host>
Content-Type: application/x-www-form-urlencoded
token=REFRESH_OR_ACCESS&token_type_hint=refresh_token&client_id=CLIENT_IDSuccess
Per RFC 7009, successful revocation typically returns 200 with an empty body even if the token was already invalid (to avoid token scanning).
Errors
| Code | Description |
|---|---|
invalid_client |
Client authentication failed. |
Notes
- Listed in /.well-known/openid-configuration.
- Not a substitute for refresh-token rotation / reuse detection on /token.