---
title: "Tunnel Revoke Token"
method: POST
path: "/tunnel/revoke"
---

# Tunnel Revoke Token

`POST /tunnel/revoke`

## Request

- Base URL: `https://api.local-mcp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.local-mcp.com/tunnel/revoke`
- Auth: none declared

Revokes a tunnel token outright (no replacement). Cuts web-AI access
immediately: the relay stops accepting it and the cloud connector rejects
its sessions. The token is the credential — same trust model as /tunnel/rotate,
only its holder can revoke it. To reconnect later, the local server issues a fresh
token on its next registration (delete cloud_token in config.json + restart).

lmcp-api#269: the presented token always revokes itself. The machine's OTHER live tokens go
too only when the machine's live device key vouches for the presented token
(_token_vouched_by_live_key). This used to revoke every live token of the machine on any
of them, and register-anon mints one for any machine_id without authentication, so anyone
could cut a machine's relay. The answer keeps {revoked, next} and adds `revoked_count`;
the only caller is the Mac uninstaller (mac/uninstall.sh and lmcp-admin's served copy),
which reads curl's exit status only.

## Request body

- TunnelRevokeRequest
  - `token` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/local-mcp/apis/lmcp-api.md) · [All operations](https://skmtc.dev/local-mcp/apis/lmcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/local-mcp/apis/lmcp-api/revisions/f1f1c502623a?raw)