Skip to content
/
Revoke token

Revoke token

Request

OAuth2 token revocation endpoint (RFC 7009). Revokes an access or refresh token issued to the authenticated client. Access and refresh tokens issued together are revoked together.

Authenticate with HTTP Basic or with client_id and client_secret in the request body, the same as the token endpoint.

token_type_hint is an optional lookup optimization; both token types are searched regardless. Per RFC 7009 Section 2.2 the endpoint returns 200 even when the token is unknown or already revoked. It cannot be used to probe for valid tokens.

Bodyapplication/x-www-form-urlencodedrequired
tokenstringrequired

The access or refresh token to revoke.

token_type_hintstring

Optional hint about the token type.

Enum:"access_token""refresh_token"
client_idstring

Client identifier. Omit when authenticating with HTTP Basic.

client_secretstring

Client secret. Omit when authenticating with HTTP Basic.

curl -i -X POST \
  https://cafe.redocly.com/_mock/openapi/cafe/oauth2/revoke \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d token=YOUR_ACCESS_TOKEN \
  -d token_type_hint=access_token \
  -d client_id=client_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d \
  -d client_secret=YOUR_CLIENT_SECRET

Responses

The token has been revoked or was already invalid.

Response
No content