RFC 7009 / START HERE
Token revocation, before the details
OAuth 2.0 Token Revocation adds a way for an application to invalidate a previously issued token.
An OAuth client is an app acting with someone’s permission. It can send an unneeded access token or refresh token to the authorization server, which manages those permissions, and ask that the token be invalidated.
The idea in one picture
App submits token
Server invalidates it
Related use depends on policy
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Deleting a token on one device does not tell the server to reject other copies. RFC7009 defines a cleanup request and response, including what happens when a token is already invalid. It also explains limits when other servers have not learned about revocation.
A familiar example
When you disconnect a fictional calendar app, it can revoke its refresh token so it cannot keep obtaining new access tokens. Existing access tokens and other sessions follow the server’s capabilities and policy; this is not automatically a global sign-out.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Send a token to the revocation endpointThe client asks the authorization server to invalidate a token it no longer needs. Deleting a local copy alone does not tell the server to revoke it.→
- A token-type hint is only a hintA lookup hint can help the authorization server search faster, but cannot redefine a token or justify skipping other supported token types.→
- Read success and failure responses carefullyHTTP 200 deliberately covers both a successfully revoked token and an invalid token. It is not a token-validity oracle or a promise about every related token.→
- Related tokens follow distinct cascade rulesRevoking one token may also affect related tokens and the authorization grant. Which relationship and which token type matter.→
- Propagate revocation to resource serversAn authorization server changing its state and every resource server learning that change are different events. Token architecture determines how revocation reaches the API.→
- Protect the endpoint and browser boundaryThe revocation endpoint receives valuable credentials. A counterfeit endpoint can steal them, and browser transport options do not replace client or token validation.→
This introduction explains RFC 7009 (2013). Read the original RFC ↗