Revoke a token
End a session by revoking its refresh token (RFC 7009).
POST /oauth/revoke
Ends a session (RFC 7009). Revoking ends the refresh token and every access token minted from it.
Authorization
None beyond the token itself: holding it is the authorization. The client
authenticates with nothing (none) and names itself with client_id.
Body
Form-encoded (application/x-www-form-urlencoded).
| Field | Type | Required | Description |
|---|---|---|---|
token | string | Yes | The refresh token. An access token that has not expired works too. |
client_id | string | Yes | The client the token was issued to. |
token_type_hint | string | No | Ignored. |
Response
200 with an empty body, whether or not the token was live. Responses carry
Cache-Control: no-store.
Errors
The body is {"error": "…"} and nothing else.
| Status | error | When |
|---|---|---|
400 | invalid_request | No token, a malformed client_id, or the host is not an org. |
Example
curl -X POST https://acme.loginwith.dev/oauth/revoke \
-d token=… \
-d client_id=cli_…