PRproof
OAuth 2.0

Revoke a Token

Revokes an access token or refresh token issued to the authenticated client, per RFC 7009. Client authentication uses client_secret_post, client_secret_basic or private_key_jwt. Responds 200 for a revoked token and for an unknown token.

post/oauth/v2/revoke

Request

  • Base URL
    https://api.proof.com
  • URL
    https://api.proof.com/oauth/v2/revoke
  • Auth
    none declared

Request body application/x-www-form-urlencoded

tokenstring required

The access token or refresh token to revoke, issued to the authenticated client.

token_type_hint'access_token' | 'refresh_token'

A token_type_hint for the submitted token.

client_idstring

Your client_id.

client_secretstring

Your client secret, for client_secret_post client authentication.

client_assertion_type'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

Set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer for private_key_jwt client authentication.

client_assertionstring

A JWT signed with one of your registered keys, for private_key_jwt client authentication: iss and sub are your client_id, aud is the issuer or the token endpoint URL, with exp and a single-use jti.

Example request

{
  "token": "the-token-to-revoke",
  "client_id": "your-client-id",
  "client_secret": "your-client-secret"
}

Response

successful

RevocationResponse required

Changes

No recorded changes to this operation across all 1 revision of this API.