---
title: "Revoke OAuth 2.0 Access or Refresh Token"
method: POST
path: "/oauth2/revoke"
tags: ["oAuth2"]
---

# Revoke OAuth 2.0 Access or Refresh Token

`POST /oauth2/revoke`

Revoking a token (both access and refresh) means that the tokens will be invalid. A revoked access token can no
longer be used to make access requests, and a revoked refresh token can no longer be used to refresh an access token.
Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by
the client the token was generated for.

## Response `200`

Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is
typically 204.

## Other responses

- `default` — errorOAuth2

## Changes

- **2023-04-07** `51ed01bdda58` — 2 info
  - added the new optional request property `client_id`
  - added the new optional request property `client_secret`
- **2022-10-27** `4505403da8d7` — 4 info
  - api tag `oAuth2` added
  - api tag `public` removed
  - removed the non-success response with the status `401`
  - removed the non-success response with the status `500`
- **2022-02-16** `82d233540486` — 2 warning, 4 info
  - removed the request property `client_id`
  - removed the request property `client_secret`
  - api tag `public` added
  - api tag `oAuth2` removed
  - …2 more

[Change history](https://skmtc.dev/ory/apis/ory-hydra-api/changes/oauth2/revoke/post.md)

---

[API](https://skmtc.dev/ory/apis/ory-hydra-api.md) · [All operations](https://skmtc.dev/ory/apis/ory-hydra-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ory/ory-hydra-api/revisions/ab053e716585/schema)