---
title: "Disconnect"
method: POST
path: "/oauth/revoke"
tags: ["Connecting an app"]
---

# Disconnect

`POST /oauth/revoke`

## Request

- Base URL: `https://verifiedhandles.org`
- URL: `https://verifiedhandles.org/oauth/revoke`
- Auth: none required

Token revocation (RFC 7009). Either of a connection’s current tokens ends the whole connection: the person consented once, so there is one thing to end. A token that is unknown, malformed, replaced, already revoked or expired answers the same empty 200, as the RFC asks. A token issued to another client is refused (`invalid_client`, 401) and nothing is revoked. Public clients only: send `client_id`, and no `Authorization` header, `client_secret` or `client_assertion` (each is refused `invalid_client`, 401).

## Response `200`

Done, or there was nothing to do. No body.

## Other responses

- `400`: `invalid_request`: not a form, a field sent twice, or `token` or `client_id` missing.
- `401`: `invalid_client`. Public clients only: send `client_id`, and no `Authorization` header, `client_secret` or `client_assertion` (each is refused `invalid_client`, 401).
- `429`: Too many requests from this IP address in the last minute (at a route that takes a key, an admin key’s are counted per key instead, at the limits set on Console → Rate limits). Wait the number of seconds `Retry-After` gives.
- `503`: Connecting apps is switched off for now (`temporarily_unavailable`). (While the site is down for maintenance, the answer is the maintenance page, as HTML.)

---

[API](https://skmtc.dev/verifiedhandles/apis/verified-handles-api.md) · [All operations](https://skmtc.dev/verifiedhandles/apis/verified-handles-api/llms.txt) · [OpenAPI document](https://skmtc.dev/verifiedhandles/apis/verified-handles-api/revisions/40720de2e0ec?raw)