Authenticate
Manage Users
Customize
Auth0 AI
PlatformEndpoint
POST /oauth/revoke
Use this endpoint to invalidate a Refresh Token if it has been compromised.
The behaviour of this endpoint depends on the state of the Refresh Token Revocation Deletes Grant toggle.
If this toggle is enabled, then each revocation request invalidates not only the specific token, but all other tokens based on the same authorization grant. This means that all Refresh Tokens that have been issued for the same user, application, and audience will be revoked.
If this toggle is disabled, then only the refresh token is revoked, while the grant is left intact.
Remarks
- For non-confidential applications that cannot keep the Client Secret safe (for example, native apps), the endpoint supports passing no Client Secret but the application itself must have the property
tokenEndpointAuthMethodset tonone. You can do this either from the UI (Dashboard > Applications > Application Settings) or using the Management API.
Learn More
Body Parameters
The
client_id of your application.A JWT containing a signed assertion with your application credentials. Required when Private Key JWT is the application authentication method.
The value is
urn:ietf:params:oauth:client-assertion-type:jwt-bearer. Required when Private Key JWT is the application authentication method.The
client_secret of your application. Required when Client Secret Basic or Client Secret Post is the application authentication method. Specifically required for Regular Web Applications only.The Refresh Token you want to revoke.