---
title: "Revoke Token"
method: POST
path: "/oauth/revoke"
tags: ["OAuth"]
---

# Revoke Token

`POST /oauth/revoke`

RFC 7009 token revocation. Revocation applies only to the submitted token: revoking a refresh token does not revoke related access tokens, so callers must revoke both tokens to end both credentials. Public clients send client_id. Confidential clients authenticate with client_id and client_secret in the form body (client_secret_post). For a valid client and well-formed request, returns 200 even if the token is unknown, to prevent token enumeration.

## Response `200`

Empty body (RFC 7009)

## Other responses

- `400` — Default Response
- `401` — invalid_client

## Changes

> 5 revisions in range; 1 not diffed.

- **2026-08-20** `304d4d4d93c7` — 1 warning
  - added the new `invalid_client` enum value to the `error` response property for the response status `401`
- **2026-08-20** `eb35c852c4b2` — 1 info
  - added the non-success response with the status `401`
- **2026-08-19** `902032aa497c` — 2 breaking
  - added required request body
  - removed the media type `application/json` for the response with the status `200`

[Change history](https://skmtc.dev/bkeyid/apis/bkey-api/changes/oauth/revoke/post.md)

---

[API](https://skmtc.dev/bkeyid/apis/bkey-api.md) · [All operations](https://skmtc.dev/bkeyid/apis/bkey-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/bkeyid/bkey-api/revisions/304d4d4d93c7/schema)