OAuth token revocation endpoint
POST/oauth2/revoke
Revokes the given refresh token. Only that one token is invalidated, not
the other tokens from the same login. A presented access token is
accepted and ignored. Always returns 200, even if the token is unknown.
The client must identify itself (RFC 7009 §5): a confidential client via
HTTP Basic base64(client_id:secret); a public client via the client_id
form parameter (no secret). Neither present → 400 invalid_request; bad
secret / unknown client → 401 invalid_client.
Request
Responses
- 200
- 400
- 401
The token (if any) has been revoked. Empty body.
invalid_request — the token is missing, or neither Basic nor client_id was supplied.
invalid_client — unknown client, or a confidential client with a bad/missing secret.