Revoke Token

🛡️

OAuth 2 Compliant

This endpoint is compliant with the Token Revocation specification.

🔐

Client Authentication

Confidential clients (i.e., BACKEND_SERVER and MACHINE_TO_MACHINE client types) must supply their client ID and secret in the Authorization header using the Basic Authentication scheme. For example, Authorization: Basic base64Encode(<client_id>:<client_secret>). Public clients that don't have a client secret can omit the Authorization header but must provide their client ID in the request body.

Revokes the specified refresh token. After a refresh token is revoked, it cannot be used again.