Skip to content
Blotout Docs

Revoke a token

POST
/oauth/revoke
curl --request POST \
  --url https://qinto-api.blotout.io/oauth/revoke \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data 'token=qor_5e0b…' \
  --data token_type_hint=refresh_token \
  --data 'client_id=qc_4b1d…' \
  --data 'client_secret=qcs_71aa…'

Revokes a qoa_ access token, or a qor_ refresh token together with its whole grant, per RFC 7009.

How it works

Client authentication follows the same rules as the token endpoint. The response is 200 whether or not the token matched: an unknown token, or a token issued to a different app, is silently ignored so the endpoint cannot be used as a validity oracle.

Request Bodyrequired

Section titled “Request Bodyrequired”

RFC 7009 form-encoded revocation request.

Media typeapplication/x-www-form-urlencoded
object
token
required

The qoa_ access token or qor_ refresh token to revoke. Revoking a refresh token revokes its whole grant.

string

Example 

qor_5e0b…
token_type_hint

Optional RFC 7009 hint (access_token or refresh_token); the token prefix already decides, so it is ignored.

string

Example 

refresh_token
client_id

The app’s client id. Required unless the client authenticates with HTTP Basic.

string

Example 

qc_4b1d…
client_secret

The app’s client secret for client_secret_post authentication. Public clients omit it.

string

Example 

qcs_71aa…

Responses

Section titled “Responses”

200

Section titled “200”

The request was processed; any matching token is revoked.

Media typeapplication/json
object
revoked
required

Always true: the request was processed. Unknown tokens and other apps’ tokens are ignored without an error.

boolean

Example 

{
  "revoked": true
}

400

Section titled “400”

invalid_request — the request body is malformed.

Media typeapplication/json
object
error
required

The RFC 6749 / RFC 8707 error code.

string
Allowed values: invalid_request invalid_client invalid_grant unsupported_grant_type invalid_scope invalid_target
error_description

A human-readable explanation of the failure, safe to log.

string

Example 

{
  "error": "invalid_request",
  "error_description": "The authorization code has expired."
}

401

Section titled “401”

invalid_client — client authentication failed.

Media typeapplication/json
object
error
required

The RFC 6749 / RFC 8707 error code.

string
Allowed values: invalid_request invalid_client invalid_grant unsupported_grant_type invalid_scope invalid_target
error_description

A human-readable explanation of the failure, safe to log.

string

Example 

{
  "error": "invalid_request",
  "error_description": "The authorization code has expired."
}