XQxquik-dev
Agent Discovery

Revoke an OAuth token

Changed on

Revoke an access token, a refresh token or a claimed agent's identity assertion. An unknown or already revoked token still returns 200.

post/api/oauth/revoke

Request

  • Base URL
    https://xquik.com
  • URL
    https://xquik.com/api/oauth/revoke
  • Auth
    none required

Request body application/x-www-form-urlencoded

client_idstring

Required unless client_assertion or a Basic Authorization header with an empty password names the client.

client_secretstring

Required for clients registered with client_secret_post.

client_assertionstring

A signed JWT for clients whose metadata document names private_key_jwt.

client_assertion_type'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

Required with client_assertion.

tokenstring required

The token to revoke.

token_type_hint'access_token' | 'refresh_token' | 'urn:ietf:params:oauth:token-type:id-jag'

The kind of token. The id-jag hint with client_id urn:xquik:agent-auth revokes a claimed agent & all its access tokens.

Example request

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_secret": "CLIENT_SECRET",
  "client_assertion": "CLIENT_ASSERTION",
  "token": "ACCESS_OR_REFRESH_TOKEN",
  "token_type_hint": "access_token"
}

Response

The token no longer works. The body is empty.

Changes