OAuth 2.0 Token Revocation (RFC 7009)

POST

/oauth/revoke

curl --request POST \
  --url https://app.buildworkpro.com/api/v1/oauth/revoke \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data token=example \
  --data token_type_hint=access_token \
  --data client_id=example \
  --data client_secret=example

• Production

Revokes an access token or refresh token. Body MUST be application/x-www-form-urlencoded. Per RFC 7009 §2.2, the response is 200 OK whether the token was successfully revoked, already revoked, expired, or unknown — this prevents leaking information about token validity. Revoking a refresh token cascades to the entire token family (all access + refresh tokens issued from the same grant). Revoking an access token does NOT cascade.

Request Body

Media type application/x-www-form-urlencoded

object

token

required

The token to revoke. Can be either an access token (prefix bwp_at_) or a refresh token (prefix bwp_rt_).

string

token_type_hint

Optional hint about the token type. The server still falls back to the other type if the hinted lookup misses (RFC 7009 §4.1.2).

string

Allowed values: access_token refresh_token

client_id

required

OAuth client identifier issued by the registration endpoint.

string

client_secret

Required for confidential clients; MUST be omitted for public clients.

string

Responses

200

Token revoked, already revoked, expired, or unknown — all return 200 per RFC 7009 §2.2

400

RFC 7009 error envelope (invalid_request, invalid_client, invalid_grant)

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

401

Client authentication failed (invalid_client)

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}