Revoke a token

POST

/oauth/revoke

Revoke an access token or refresh token. Per the OAuth specification, this endpoint returns 200 OK even if the token is invalid or already revoked.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200OK

Token revoked (or already invalid)

This response does not have a body.

Request Example

Shell

JavaScript

Java

Swift

curl --location '/oauth/revoke' \
--header 'Content-Type: application/json' \
--data '{
    "token": "opaque_access_or_refresh_token",
    "token_type_hint": "access_token"
}'

Modified at 2026-04-08 17:24:40

Exchange code or refresh token

OAuth discovery / client metadata