ORory
oAuth2

Revoke OAuth 2.0 Access or Refresh Token

Changed on

Revoking a token (both access and refresh) means that the tokens will be invalid. A revoked access token can no longer be used to make access requests, and a revoked refresh token can no longer be used to refresh an access token. Revoking a refresh token also invalidates the access token that was created with it. A token may only be revoked by the client the token was generated for.

post/oauth2/revoke

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /oauth2/revoke
  • Auth
    • HTTP basic
    • or OAuth 2
      Authorization code: https://hydra.demo.ory.sh/oauth2/auth
      Token URL: https://hydra.demo.ory.sh/oauth2/token

Request body application/x-www-form-urlencoded

tokenstring required
client_idstring
client_secretstring

Response

Empty responses are sent when, for example, resources are deleted. The HTTP status code for empty responses is typically 204.

Changes