OAuth

Revoke Endpoint

Changed on

Revoke a token (RFC 7009). Always returns 200 for valid requests.

Two client-authentication arms, negotiated on the request content type by _RevocationRoute (this function body IS the JSON arm — form-encoded requests never reach it):

  • Form-encoded (application/x-www-form-urlencoded, RFC 7009 §2.1 — the shape MCP OAuth clients send, G11): token + optional token_type_hint + client_id. Public (secret-less) clients authenticate by client_id lineage binding — the call revokes anything only when the token exists and was issued to that client_id; everything else is a 200 no-op (no token-validity oracle). Revoking an access token kills that token only; revoking a refresh token is a full disconnect — every token of the consent grant AND the grant row itself die, so reconnecting requires fresh consent (deliberately beyond the RFC 7009 §2.1 SHOULD; one revocation semantics platform-wide). This arm is gated by server.mcp.oauth.enabled (plain 404 when off), capped at 64 KiB declared body length, and per-IP rate limited; its errors speak the RFC 6749 §5.2 dialect (RFC 7009 §2.2.1), not Problem Details.
  • JSON (any other content type — the pre-G11 contract, byte-identical including 422 shapes): requires a platform bearer identity; revokes the caller's own token (access → that token, refresh → its family). Used by jentic logout.

Revocation residual: a revoked access token dies on the control-plane resolver immediately, but the broker's CachedTokenValidator (30 s TTL) may honour an already-cached verdict for up to 30 s — the same residual as the UI :revoke kill switch and the G10 transfer sweep.

post/oauth/revoke

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /oauth/revoke
  • Auth: none required

Request body

client_idstring nullable

Public client's client_id, used on form-encoded requests; ignored on bearer-authenticated JSON requests.

tokenstring required

The token to revoke.

token_type_hintstring nullable

Optional hint, access_token or refresh_token; both types are checked regardless.

Example request

{
  "client_id": "oc_Xk3vQ9mT2pLw8RzN5bYc1HdF7gJs4AeU",
  "token": "rt_example-refresh-token",
  "token_type_hint": "refresh_token"
}

Response

Successful Response

unknown required

Changes

  • a60e7cd27ce9Revision changes
    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

    • info

      added the media type application/json for the response with the status

  • 0e18af18e1faRevision changes
    • breaking

      removed the media type application/problem+json for the response with the status

    • info

      the endpoint scheme security BearerAuth was removed from the API

    • info

      added the new optional request property

    • info

      added the media type application/x-www-form-urlencoded to the request body

    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

    • info

      removed the non-success response with the status