StudioHomepage
ServicesAuthenticationHTTP APIAuthorization server

Revoke a token

POST
/oauth/revoke

The revocation endpoint (RFC 7009 §2.1). Revoke an access token or a refresh token that was issued to your client. Revocation ends the user session, so its refresh tokens stop working. An access token stays valid until it expires, because Spiral services verify it without asking the authorization server. A token that the server does not know returns success (RFC 7009 §2.2). Send the client_id of the client that the token was issued to. A third-party application whose registration names a jwks_uri also sends a private_key_jwt assertion (RFC 7523 §2.2).

Request Body

application/x-www-form-urlencoded
  1. body

A revocation request (RFC 7009 §2.1).

token*string
token_type_hint?string
Value in"access_token""refresh_token"
client_id*string
client_assertion_type?string
client_assertion?string

Response Body

The token is revoked, or the server does not know it. The body is empty.

curl -X POST 'https://auth.spiraldb.com/oauth/revoke' \  -H 'Content-Type: application/x-www-form-urlencoded' \  -d 'token=string&client_id=string'
Empty