---
title: "Oauth Revoke"
method: POST
path: "/oauth/revoke"
tags: ["oauth"]
---

# Oauth Revoke

`POST /oauth/revoke`

## Request

- Base URL: `https://api.slideforge.dev`
- URL: `https://api.slideforge.dev/oauth/revoke`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

RFC 7009 token revocation — ADR-2026-08-01 clause 5.

Proxies revocation to Auth0 and drops our matching grant rows. This is what lets a client's
"disconnect" actually kill the long-lived credential rather than merely forgetting it.

Bounded on purpose: revoking a refresh token does NOT end the session. The outstanding access
token stays valid until `exp` (24h in prod) plus up to 30 min of middleware token cache. That
bound exists today for every access token; this endpoint does not widen it and does not claim
to close it.

Per RFC 7009 §2.2 an unknown or already-revoked token is a SUCCESS, not an error — otherwise
the endpoint becomes a token-validity oracle.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/slideforge/apis/slideforge-api.md) · [All operations](https://skmtc.dev/slideforge/apis/slideforge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/slideforge/apis/slideforge-api/revisions/ae698e3d3c00?raw)