Revoke Refresh Token

Revoke a refresh token to prevent it from being used to obtain new access tokens. Once revoked, the refresh token can no longer be used.

Use cases:

• User logout
• Security concerns (token compromise)
• User revokes application access

Note: This endpoint only revokes refresh tokens. Access tokens cannot be revoked and will remain valid until they expire.

POST https://{yourDomain}/oauth/revoke

Revoke Refresh Token

cURL

curl --request POST \
  --url https://{yourDomain}/oauth/revoke \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=YOUR_CLIENT_ID \
  --data client_secret=YOUR_CLIENT_SECRET \
  --data token=YOUR_REFRESH_TOKEN

200

"OK"

Authorizations

Authorization · string · header · required

The access token received from the authorization server in the OAuth 2.0 flow.

Body

application/x-www-form-urlencoded

client_id · string · required

Your application's Client ID

token · string · required

The refresh token you want to revoke

client_secret · string

Your application's Client Secret (required for confidential clients)

client_assertion · string

A JWT signed with your client secret or private key (for Private Key JWT authentication)

client_assertion_type · enum<string>

Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion

Available options: urn:ietf:params:oauth:client-assertion-type:jwt-bearer

Response

200

text/plain

Token revoked successfully (or token was already invalid/revoked)

The response is of type string.