Revokes a refresh token issued to the calling application, following RFC 7009. Use it when a user signs out of a client so that the client’s refresh token can no longer be exchanged for new tokens.
The endpoint authenticates clients the same way as the token endpoint: a confidential client sends its client ID and client secret in the request body or an Authorization: Basic header, a public client sends only its client_id, and a client registered with a Client ID Metadata Document can send a JWT client assertion (private_key_jwt) where JWT client assertions are enabled. The authentication methods are also listed as revocation_endpoint_auth_methods_supported in the metadata endpoints.
Revoking a refresh token also revokes the refresh tokens it was rotated into and stops any refresh token it was rotated from being replayed. The user’s authorization for the application stays in place: other refresh tokens the application holds for the user, such as those on other devices, keep working. Access tokens that were already issued stay valid until they expire. To remove the authorization and all of its refresh tokens, delete the user’s authorized application.
The endpoint responds with an empty 200 response when the token is revoked, and also for tokens that are unknown, expired, or already revoked. A refresh token issued to a different application is rejected with an invalid_grant error and stays valid, and a request without client authentication is rejected with a 401 invalid_client error.
Connect access tokens and AuthKit session refresh tokens are rejected with an unsupported_token_type error. To end an AuthKit session, revoke the session instead.
| curl -X POST https://authkit_domain/oauth2/revoke \ | |
| -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ | |
| -d "client_secret=1eaaf7a47948398d89e2b07dce912b6a9c0282aa20e88c026fcb42fd6b06b73e" \ | |
| -d "token=ZAJRNDtWE6jcTvBXe9nnGlycw" \ | |
| -d "token_type_hint=refresh_token" |
POST