Revoke
RFC 7009. Always answers 200, even for a token that was never valid, so it can't be used to test whether a token is live.
Revoking a refresh token ends the whole authorization and takes its access tokens with it. Revoking an access token affects only that token.
Request body
application/x-www-form-urlencoded
tokenrequiredstringAn access token or a refresh token.
client_idstringAccepted and not checked.
Responses
200application/json
Always, whatever was presented.
object
TypeScript type
Record<string, unknown>