Accounts & authentication

Revoke an OAuth token

POST /oauth/revoke

Send a form-encoded token and optionally client_id. Revoking an access token ends that token; revoking a refresh token ends its grant and every token in it, and records the client as the actor. Unknown and already-ended tokens answer 200.

Parameters

Idempotency-Keyheader · optional · string

Makes a retry safe: a request with the same key and the same method, path, and body as an earlier one gets the earlier response instead of doing the work again. 1 to 255 visible ASCII characters; use a new key for each new request, such as a UUID. Keys are kept per caller for a day, and ignored for requests without credentials.

Minimum length: 1 · Maximum length: 255

Example request

curl --request POST 'https://commitscale.com/oauth/revoke'

Example values illustrate the format. Use your own credentials and identifiers.

Request body

application/x-www-form-urlencoded

Responses

200 The token is no longer usable, or was unknown.

RateLimit and RateLimit-Policy describe the request rate. Follow Retry-After when a response asks you to wait.

Problem responses

Errors use application/problem+json. Act on the stable code, and follow next when present. See the problem format.

quota_exceeded429

With 429, the caller used its requests for the minute. With 422, a count limit was reached.

With 429, wait Retry-After seconds and retry. With 422, remove one first.