OAuth 2.0

OAuth 2.0 Token Revocation

post/oauth/revoke

Token revocation endpoint (RFC 7009). Revokes an access or refresh token. The server responds with HTTP 200 regardless of whether the token was valid, to prevent token scanning attacks.

bash

Sample request123
curl --request POST 'https://api.eu-west-1.aws.dash0.com/oauth/revoke' \
  --data-urlencode 'token=example' \
  --data-urlencode 'client_id=example'

Server

Request body required

References OAuthRevocationRequest

object

stringrequired

The token to be revoked.

stringrequired

The identifier of the client the token was issued to. RFC 7009 section 2.1 requires the revocation request to be authenticated as that client, so a token issued to a different client is left untouched (the response is still 200).

OAuthTokenType

Hint about the type of the token being revoked. Helps the server optimize lookup.

"access_token""refresh_token"

Responses

Token revocation request processed. Returns 200 regardless of whether the token was valid.