.svg?fit=max&auto=format&n=BeJnxPC-1rIwaIyX&q=85&s=29c28b33f586cd7f5982d9c0056af55a)
curl --request POST \
--url https://api.bkey.id/oauth/revoke \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data token=rt_example \
--data token_type_hint=refresh_token \
--data client_id=bkey_client_example{
"error": "<string>",
"error_description": "<string>",
"error_uri": "<string>"
}{
"error": "invalid_client",
"error_description": "<string>",
"error_uri": "<string>"
}OAuth 2.1 & OIDC
Revoke Token
RFC 7009 token revocation. Revocation applies only to the submitted token: revoking a refresh token does not revoke related access tokens, so callers must revoke both tokens to end both credentials. Public clients send client_id. Confidential clients authenticate with client_id and client_secret in the form body (client_secret_post). For a valid client and well-formed request, returns 200 even if the token is unknown, to prevent token enumeration.
POST
/
oauth
/
revoke
curl --request POST \
--url https://api.bkey.id/oauth/revoke \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data token=rt_example \
--data token_type_hint=refresh_token \
--data client_id=bkey_client_example{
"error": "<string>",
"error_description": "<string>",
"error_uri": "<string>"
}{
"error": "invalid_client",
"error_description": "<string>",
"error_uri": "<string>"
}Body
application/x-www-form-urlencoded
Access or refresh token to revoke
OAuth client identifier
Optional hint that identifies the token type
Available options:
access_token, refresh_token Required for confidential clients and omitted by public clients
Response
Empty body (RFC 7009)