Send a token to the revocation endpoint
01The client asks the authorization server to invalidate a token it no longer needs. Deleting a local copy alone does not tell the server to revoke it.
The confidential-client example passes authentication and ownership checks before the token moves from active to revoked. Failed validation refuses the request; an authentication secret is not required of every public client.
Source for this drawing: RFC 7009 · Read RFC section 2.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Access token
- A credential used to request access to a protected resource.
- Refresh token
- A credential used to obtain new access tokens, rather than to call the protected API.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Implementations MUST support refresh-token revocation and SHOULD support access-token revocation. These are different requirements, not a guarantee that every server can revoke every token type.
- Implementations MUST support refresh-token revocation and SHOULD support access-token revocation. These are different requirements, not a guarantee that every server can revoke every token type.
- Send an HTTP POST to the HTTPS revocation endpoint with application/x-www-form-urlencoded body data. token is REQUIRED; token_type_hint is OPTIONAL.
- Include client authentication as specified by RFC 6749 §2.3. For a confidential client the server first validates credentials, then verifies that the token was issued to that client, before invalidating it.
- An endpoint is not inferred from the API URL: its discovery is out of scope and its location must come from a trustworthy source. The client MUST verify HTTPS and authenticate the endpoint.
The example URL and token are fictional. Join the form fields token=demo%2Btoken%2F%3D and token_type_hint=refresh_token with an ampersand. The token decodes to demo+token/=, not demo token/=. The Authorization field represents the configured confidential-client authentication, not the token being revoked used as a Bearer credential. A public client supplies a valid client_id (§5); that identifier is not a secret or proof of identity. Revocation is not a standardized global browser logout.
Read the RFC section ↗