---
title: "Revoke a token (RFC 7009)"
method: POST
path: "/oauth/revoke"
tags: ["MCP OAuth"]
---

# Revoke a token (RFC 7009)

`POST /oauth/revoke`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/oauth/revoke`
- Auth: none required

Revoking either an access token or a refresh token kills the ENTIRE grant it belongs to, not just the token presented — a client the user disconnected must not keep a live refresh token. Accepts form-encoded or JSON and authenticates the client exactly as `POST /oauth/token` does. Always answers 200, including for unknown, already-revoked, or another client's token, so this endpoint cannot be used as a token oracle. To revoke from the user side instead, use `DELETE /oauth/grant/{id}`.

## Request body

- object

## Response `200`

Always returned on a well-formed, client-authenticated request. Body is `{}`.

- object

## Other responses

- `400`: `invalid_request` — `token` is missing.
- `401`: `invalid_client` — client authentication failed.
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited (`temporarily_unavailable`), with `Retry-After`.

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)