Skip to content
OpenID Connect & OAuth 2....
/
/
/revoke

/revoke

Request

CORS

The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See Revoke tokens.

Note: The /revoke endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Path
authorizationServerIdstringrequired

id of the authorization server

Bodyapplication/x-www-form-urlencoded
tokenstringrequired

An access token, refresh token, or a device secret

Example:"<access_token_value>"
token_type_hintstring(TokenTypeHintRevokeCustomAs)

Indicates the type of token being passed

Enum ValueDescription
access_token

OAuth 2.0 access token

device_secret

Device secret

refresh_token

OAuth 2.0 refresh token

Example:"access_token"
POST
/oauth2/{authorizationServerId}/v1/revoke
curl -i -X POST \
  'https://okta-subdomain.pixtulate.com/oauth2/{authorizationServerId}/v1/revoke' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'token=<access_token_value>' \
  -d token_type_hint=access_token

Responses

Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked.

Response
No content