Revoke tokens
3 min
You can revoke the tokens generated by the Authorization code flow.
Revoke access token
Revoke an access_token by making an HTTP POST request to the authorization server.
HTTP POST
https://accounts.welcomesoftware.com/o/oauth2/v1/revoke
Request payload:
{
"token" : "bd680785-b090-40ca-9a32-22df51e96e7a",
"token_type_hint" : "access_token",
"client_id" : "12345678-1234-1234-1234-123456789012",
"client_secret" : "my-encrypted-secret-1234"
}
Response payload:
{
"msg" : "success"
}Revoke refresh token
Revoke a refresh_token by making an HTTP POST request to the authorization server.
HTTP POST
https://accounts.welcomesoftware.com/o/oauth2/v1/revoke
Request payload:
{
"token" : "e053d83e-14e1-4ba4-b18e-ea654b39a02e",
"token_type_hint" : "refresh_token",
"client_id" : "12345678-1234-1234-1234-123456789012",
"client_secret" : "my-encrypted-secret-1234"
}
Response payload:
{
"msg" : "success"
}Revoke token without mentioning any token type
Revoke a token without passing the token_hint_type field in the request payload. The passed token can be an access_token or a refresh_token. The authorization server automatically deduces the type of the token and revokes it.
HTTP POST
https://accounts.welcomesoftware.com/o/oauth2/v1/revoke
Request payload:
{
"token" : "e053d83e-14e1-4ba4-b18e-ea654b39a02e",
"client_id" : "12345678-1234-1234-1234-123456789012",
"client_secret" : "my-encrypted-secret-1234"
}
Response payload:
{
"msg" : "success"
}