OAuth token revocation endpoint
POST/oauth2/revoke
Ends the login the refresh token belongs to: its whole refresh family, for that application only. An access token is accepted and ignored. Always 200, even for an unknown token.
The client identifies itself with HTTP Basic (confidential) or the client_id form field (public). Neither returns 400 invalid_request; a bad secret or unknown client returns 401 invalid_client.
Request
Responses
- 200
- 400
- 401
The token (if any) has been revoked. Empty body.
invalid_request — the token is missing, or neither Basic nor client_id was supplied.
invalid_client — unknown client, or a confidential client with a bad/missing secret.