1. Docs
  2. API Reference
  3. Revoke a token

Revoke a token

POST/oauth/revoke

OAuth2 token revocation endpoint (POST /oauth/revoke). Revokes the supplied token, invalidating the associated refresh token. Answers 200 whether or not the token was known, as RFC 7009 requires, so a caller learns nothing about tokens it does not hold. Refusals use the RFC 6749 form { error, error_description }: 400 for a malformed request, 401 with invalid_client when client authentication fails.

Request body

application/json

tokenstring Required
client_idstring Optional

Client id, when authenticating with `client_secret_post`. Omit it and send `Authorization: Basic` instead for `client_secret_basic`.

client_secretstring Optional

Client secret, when authenticating with `client_secret_post`.

token_type_hintstring Optional

Which kind of token is being revoked. A hint only, per RFC 7009; the token is matched either way.

Responses

Revoked. RFC 7009 answers 200 for an unrecognised token too, so a client cannot use this endpoint to learn whether a token exists or whose it is.

application/json

  • errorstring*
  • error_descriptionstring*

application/json

  • errorstring*
  • error_descriptionstring*
Request
curl -X POST "https://auth.canopy-io.com/oauth/revoke" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "string",
    "client_id": "string",
    "client_secret": "string",
    "token_type_hint": "string"
  }'
Response
HTTP/1.1 200 Revoked. RFC 7009 answers 200 for an unrecognised token too, so a client cannot use this endpoint to learn whether a token exists or whose it is.

(empty body)
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy