---
title: "Revoke Token"
method: DELETE
path: "/auth/tokens/{token_id}"
tags: ["auth"]
---

# Revoke Token

`DELETE /auth/tokens/{token_id}`

Soft-revoke one of the caller's own personal access tokens (idempotent).

Scoped to the caller's own keys (``subject_id``), mirroring ``list_tokens`` —
you cannot revoke another user's PAT even within your conglomerate (matters
once a conglomerate has multiple users). Follows the ownership canon: a
genuinely-missing token is 404, a token owned by someone else is 403
(foreign-but-existing), never masked as 404. Only PATs are revocable here; the
login session (``cli_session``) is revoked via ``logout``.

## Path parameters

- `token_id` string, uuid, required

## Response `204`

Successful Response

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/nanocorp/apis/nanocorp-api.md) · [All operations](https://skmtc.dev/nanocorp/apis/nanocorp-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nanocorp/nanocorp-api/revisions/04b208d3215b/schema)