- URL:https://[root]/oauth2/revokeToken(POST only)
URL for Revoke Token
The Revoke Token operation (POST only, HTTPS only) invalidates OAuth2 access or refresh token. Applications can use this endpoint when a user signs out of the app so that no abandoned tokens are left valid.
An access token is issued from implicit grant and a refresh token can be revoked with this operation. When a refresh token is revoked, all access tokens generated from the refresh token will also be revoked. Revoking an app access token and tokens generated from generate token are not supported with this operation. A success response will be returned revoking either an invalid, expired token or of an unsupported type to prevent leaking information about the passed-in token.
For a complete listing, see common parameters.
The access token or refresh token to revoke.
(Optional) Specify the type of token passed in for auth_token.
Supported values: access_token | refresh_token
The ID of the registered application that was used to generate the token to be revoked. An application can only revoke its own tokens; if the client id does not match the one from which the token was generated, the token will not be revoked.
Indicates whether the operation was successful.
JSON Response syntax
JSON Response example
"message": "Invalid client_id",