# Token revocation Revokes a refresh token issued to the calling application, following [RFC 7009](https://datatracker.ietf.org/doc/html/rfc7009). Use it when a user signs out of a client so that the client's refresh token can no longer be exchanged for new tokens. The endpoint authenticates clients the same way as the [token endpoint](https://workos.com/docs/reference/workos-connect/token): a confidential client sends its client ID and client secret in the request body or an `Authorization: Basic` header, a public client sends only its `client_id`, and a client registered with a Client ID Metadata Document can send a JWT client assertion (`private_key_jwt`) where JWT client assertions are enabled. The authentication methods are also listed as `revocation_endpoint_auth_methods_supported` in the [metadata](https://workos.com/docs/reference/workos-connect/metadata) endpoints. Revoking a refresh token also revokes the refresh tokens it was rotated into and stops any refresh token it was rotated from being replayed. The user's authorization for the application stays in place: other refresh tokens the application holds for the user, such as those on other devices, keep working. Access tokens that were already issued stay valid until they expire. To remove the authorization and all of its refresh tokens, [delete the user's authorized application](https://workos.com/docs/reference/authkit/user/authorized-application/delete). The endpoint responds with an empty `200` response when the token is revoked, and also for tokens that are unknown, expired, or already revoked. A refresh token issued to a different application is rejected with an `invalid_grant` error and stays valid, and a request without client authentication is rejected with a `401` `invalid_client` error. Connect access tokens and AuthKit session refresh tokens are rejected with an `unsupported_token_type` error. To end an AuthKit session, [revoke the session](https://workos.com/docs/reference/authkit/session/revoke) instead. :::code-group ```bash language="curl" title="Request" tab="1" curl -X POST https://authkit_domain/oauth2/revoke \ -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ -d "client_secret=1eaaf7a47948398d89e2b07dce912b6a9c0282aa20e88c026fcb42fd6b06b73e" \ -d "token=ZAJRNDtWE6jcTvBXe9nnGlycw" \ -d "token_type_hint=refresh_token" ``` ::: ### POST /oauth2/revoke #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `client_id` | string | Yes | workos_connect_token_request.client_id | | `client_secret` | string | No | The client secret of a confidential client. Public clients, such as MCP clients registered through Client ID Metadata Documents or Dynamic Client Registration with no client secret, send only their `client_id`. | | `token` | string | Yes | The refresh token to revoke. | | `token_type_hint` | "refresh_token" \| "access_token" | No | An optional hint for the type of token provided. Refresh tokens are revoked whichever hint is sent. |