---
title: "Revoke all app tokens"
method: POST
path: "/oauth-clients/{appId}/revoke-all-tokens"
tags: ["OAuth Apps"]
---

# Revoke all app tokens

`POST /oauth-clients/{appId}/revoke-all-tokens`

## Request

- Base URL: `https://app.pipeshub.com/api/v1`
- URL: `https://app.pipeshub.com/api/v1/oauth-clients/{appId}/revoke-all-tokens`
- Auth: HTTP bearer

Revokes every access and refresh token currently issued to an OAuth app, in a single operation. Use this for emergency credential rotation, suspected secret leaks, or as a follow-up to `POST /oauth-clients/{appId}/regenerate-secret` when you want existing sessions invalidated immediately rather than letting them expire naturally.

The response carries only a confirmation `message`; it does not say how many tokens were revoked. Clients of this app must then obtain new tokens via the standard OAuth flow.

Creator-only.

## Path parameters

- `appId` string, required

## Response `200`

All tokens revoked

- object
  - `message` string, required

## Other responses

- `400`: `appId` is not a 24-character hex id (`VALIDATION_ERROR` naming `params.appId`) Also returned, before authentication, when a query value, or any string in a JSON or form-encoded body, looks like markup to the app-wide XSS filter: an HTML tag, a script tag, `<iframe`, `<object`, `<embed` or `<svg` tag, a word starting with `on` followed by `=` (meant for inline event handlers such as `onerror=`, it also catches plain text such as `one=1`), a `javascript:` or `data:text/html` URL, an encoded script tag (`&lt;script`, `%3cscript`), or any string longer than 100,000 characters (`HTTP_BAD_REQUEST`, "HTML tags, scripts, and XSS content are not allowed in ...", naming the field or query parameter; a string over 100,000 characters is refused as too long instead). A JSON body that does not parse is refused the same way, also before authentication (`HTTP_BAD_REQUEST`, "The request body is not valid JSON.").
- `401`: Unauthorized
- `403`: Bearer token is an OAuth access token or personal access token rather than a user session, or the caller is a service account. An app the caller did not create is 404, not 403.
- `404`: OAuth app not found or not visible to this caller (each user only sees apps they created)
- `429`: Rate limit exceeded
- `500`: Internal server error. A JSON body larger than 10 MB, or a form-encoded body larger than 100 KB or with more than 1000 fields, is answered `413` by the app-wide body parsers instead, also before authentication.

## Changes

- **2026-10-28** `dbb5e203b445`: 1 warning, 6 info
  - removed the optional property `count` from the response with the `200` status
  - added the non-success response with the status `400`
  - added the non-success response with the status `500`
  - added the optional property `error/requestId` to the response with the `401` status
  - …3 more

[Operation history](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/changes/oauth-clients/:appId/revoke-all-tokens/post.md)

---

[API](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api.md) - [All operations](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/revisions/dbb5e203b445?raw)