Skip To Content ArcGIS for Developers Sign In Dashboard

Revoke Token

Description

The revoke token operation (POST only, HTTPS only) invalidates OAuth2 access or refresh token. Applications can use this endpoint when a user signs out of the app so that no abandoned tokens are left valid.

Access token issued from implicit grant and refresh token can be revoked with this operation. When a refresh token is revoked, all access tokens generated from the refresh token will also be revoked. Revoking app access token and tokens generated from generate token are not supported with this operation. A success response will be returned revoking either an invalid, expired token or of a unsupported type in order to prevent leaking information about the passed-in token.

Request Parameters

ParameterDetails
[Common Parameters]

For a complete listing, see common parameters.

auth_token

The access token or refresh token to revoke.

token_type_hint

(Optional) specify the type of token passed in for auth_token.

Supported values: access_token | refresh_token

client_id

The ID of the registered application that was used to generate the token to be revoked. An application can only revoke its own tokens, if the client id does not match with the one from which the token was generated, the token will not be revoked.

Example: client_id=GGjeDjEY6kKEiDmX

Response Properties

PropertyDetails
success

Indicates if the operation was successful.

Example Usage

URL for Revoke Token

https://www.arcgis.com/sharing/rest/oauth2/revokeToken

JSON Response Syntax

{"success": true}

JSON Response Example

{"success": true}

or 

{"error": {
 "code": 400,
 "message": "Invalid client_id",
 "details": []
}}