Skip to content
OpenID Connect & OAuth 2....
/
/
/revoke

/revoke

Request

CORS

The API takes an access or refresh token and revokes it. Revoked tokens are considered inactive at the introspection endpoint. A client may only revoke its own tokens. See Revoke tokens.

Note: The /revoke endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Bodyapplication/x-www-form-urlencoded
tokenstringrequired

The token to revoke

Example:"<access_token_value>"
token_type_hintstring(TokenTypeHintRevokeOrgAs)

Indicates the type of token being passed

Enum ValueDescription
access_token

OAuth 2.0 access token

device_secret

Device secret

refresh_token

OAuth 2.0 refresh token

oauth_sts

OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents.

Example:"access_token"
POST
/oauth2/v1/revoke
curl -i -X POST \
  https://okta-subdomain.pixtulate.com/oauth2/v1/revoke \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'token=<access_token_value>' \
  -d token_type_hint=access_token

Responses

Successful Revocation. Note that revoking an invalid, expired, or revoked token is still considered a success so information isn't leaked.

Response
No content