---
title: "Revoke a key or refresh token"
method: POST
path: "/oauth/revoke"
tags: ["Authentication"]
---

# Revoke a key or refresh token

`POST /oauth/revoke`

## Request

- Base URL: `https://api.app.layer.ai/api`
- URL: `https://api.app.layer.ai/api/oauth/revoke`
- Auth: none required

OAuth 2.0 token revocation (RFC 7009). A service account authenticates as for the token endpoint; revoking one of its keys ends the key and every access token exchanged for it. Access tokens are not revocable one by one (RFC 7009 section 2 lets a server decline): one sent here is answered with 200 and keeps working until it expires, at most an hour later. An unknown, expired or foreign token is answered the same way, so the response says nothing about it.

A native client signs a person out by sending its refresh token with its `client_id` and no secret, which ends that refresh token.

## Response `200`

Successful Response

- unknown

## Other responses

- `401`: Client authentication failed
- `422`: Validation Error

## Changes

- **2026-10-11** `2d86d473cda6`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/layer/apis/layer-rest-api/changes/oauth/revoke/post.md)

---

[API](https://skmtc.dev/layer/apis/layer-rest-api.md) · [All operations](https://skmtc.dev/layer/apis/layer-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/layer/apis/layer-rest-api/revisions/326f3bcdabcc?raw)