> ## Documentation Index
> Fetch the complete documentation index at: https://docs.member.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Oauth Revoke

> Token Revocation Endpoint (RFC 7009).

Accepts a token (access or refresh) via application/x-www-form-urlencoded.
Optional token_type_hint is accepted but not required.

SECURITY:
- Confidential clients MUST authenticate via client_secret_basic (RFC 7009 §2.1).
  Missing or wrong secret → 401 invalid_client.
- The presented token's RS256 signature is VERIFIED before any revocation
  state changes (a forged token can never blacklist a victim's jti). Token
  ownership is enforced — a client may only revoke a token issued to IT.
- For a valid, owned, unknown, or forged token the response is 200 with an
  empty body (RFC 7009 §2.2 — no info leak about token existence/ownership).
- Revoking a refresh token also drops the entire Valkey refresh family so
  sibling tokens (stolen copies) are immediately dead.
- A genuine STORAGE/infra failure during the blacklist or family write is NOT
  swallowed — it propagates as a 5xx so we never report a false "revoked" 200.

This is an OAuth2 standard endpoint — NOT JSON:API.



## OpenAPI

````yaml /openapi/mio-openapi.json post /oauth/revoke
openapi: 3.1.0
info:
  description: >-
    Production API reference for Membership.io. Use the authored guides for
    workflows and the generated endpoint pages for exact parameters and schemas.
  title: Membership.io API
  version: 0.1.0
servers:
  - description: Production
    url: https://api.member.dev
security:
  - bearerAuth: []
paths:
  /oauth/revoke:
    post:
      tags:
        - oauth
      summary: Oauth Revoke
      description: >-
        Token Revocation Endpoint (RFC 7009).


        Accepts a token (access or refresh) via
        application/x-www-form-urlencoded.

        Optional token_type_hint is accepted but not required.


        SECURITY:

        - Confidential clients MUST authenticate via client_secret_basic (RFC
        7009 §2.1).
          Missing or wrong secret → 401 invalid_client.
        - The presented token's RS256 signature is VERIFIED before any
        revocation
          state changes (a forged token can never blacklist a victim's jti). Token
          ownership is enforced — a client may only revoke a token issued to IT.
        - For a valid, owned, unknown, or forged token the response is 200 with
        an
          empty body (RFC 7009 §2.2 — no info leak about token existence/ownership).
        - Revoking a refresh token also drops the entire Valkey refresh family
        so
          sibling tokens (stolen copies) are immediately dead.
        - A genuine STORAGE/infra failure during the blacklist or family write
        is NOT
          swallowed — it propagates as a 5xx so we never report a false "revoked" 200.

        This is an OAuth2 standard endpoint — NOT JSON:API.
      operationId: oauth.post_oauth_post_oauth_revoke
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema: {}
          description: Successful Response
components:
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or mio_sk API key
      description: >-
        Send platform JWTs, contact JWTs, or team API keys as `Authorization:
        Bearer <token>`.
      scheme: bearer
      type: http

````