Oauth Revoke
oauth
Oauth Revoke
Token Revocation Endpoint (RFC 7009).
Accepts a token (access or refresh) via application/x-www-form-urlencoded. Optional token_type_hint is accepted but not required.
SECURITY:
- Confidential clients MUST authenticate via client_secret_basic (RFC 7009 §2.1). Missing or wrong secret → 401 invalid_client.
- The presented token’s RS256 signature is VERIFIED before any revocation state changes (a forged token can never blacklist a victim’s jti). Token ownership is enforced — a client may only revoke a token issued to IT.
- For a valid, owned, unknown, or forged token the response is 200 with an empty body (RFC 7009 §2.2 — no info leak about token existence/ownership).
- Revoking a refresh token also drops the entire Valkey refresh family so sibling tokens (stolen copies) are immediately dead.
- A genuine STORAGE/infra failure during the blacklist or family write is NOT swallowed — it propagates as a 5xx so we never report a false “revoked” 200.
This is an OAuth2 standard endpoint — NOT JSON:API.
POST
Oauth Revoke
Authorizations
Send platform JWTs, contact JWTs, or team API keys as Authorization: Bearer <token>.
Response
200 - application/vnd.api+json
Successful Response