OAuth 2.0 Token Revocation (RFC 7009)

POST

/oauth/revoke

• Production

Revokes an access token or refresh token. Body MUST be application/x-www-form-urlencoded. Per RFC 7009 §2.2, the response is 200 OK whether the token was successfully revoked, already revoked, expired, or unknown — this prevents leaking information about token validity. Revoking a refresh token cascades to the entire token family (all access + refresh tokens issued from the same grant). Revoking an access token does NOT cascade.

Request Body

object

token

required

The token to revoke. Can be either an access token (prefix bwp_at_) or a refresh token (prefix bwp_rt_).

string

token_type_hint

Optional hint about the token type. The server still falls back to the other type if the hinted lookup misses (RFC 7009 §4.1.2).

string

Allowed values: access_token refresh_token

client_id

required

OAuth client identifier issued by the registration endpoint.

string

client_secret

Required for confidential clients; MUST be omitted for public clients.

string

Responses

200

Token revoked, already revoked, expired, or unknown — all return 200 per RFC 7009 §2.2

400

RFC 7009 error envelope (invalid_request, invalid_client, invalid_grant)

object

error

required

string

error_description

string

401

Client authentication failed (invalid_client)

object

error

required

string

error_description

string