Revoke an access or refresh token

POST

/oauth/revoke

const url = 'https://api.adversarial.com/api/oauth/revoke';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: new URLSearchParams({token: 'example', token_type_hint: 'example'})
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.adversarial.com/api/oauth/revoke \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data token=example \
  --data token_type_hint=example

Token revocation (RFC 7009). Submit the token to invalidate it. Per the specification this always responds 200, whether or not the token existed, so callers cannot use it to probe for valid tokens.

Request Body^required

application/x-www-form-urlencoded

object

token

required

string

token_type_hint

Hint about the token kind (RFC 7009). We ignore it because all lookup is by hash — but accepting it keeps the endpoint spec-shaped.

string | null

Example^generated

token=example&token_type_hint=example

Responses

200

Revocation processed (always 200 per RFC 7009)

Revoke an access or refresh token

Request Bodyrequired

Examplegenerated

Responses

200

Request Body^required

Example^generated