Skip to main content
POST
Revoke an access token
Revoke an access token before it expires, such as when your integration finishes a task or if you suspect the token was exposed. Authenticate with the client credentials of the OAuth application the token was issued to. A successful request returns 200 OK with an empty body. The endpoint also returns 200 OK if the token is already expired, revoked, unknown, or issued to a different OAuth application, so revocation requests are safe to retry. To revoke all tokens issued to an integration at once, revoke the OAuth application in your 1Password account.

Authorizations

Authorization
string
header
required

HTTP Basic authentication with the OAuth application's client credentials: the client ID as the username and the client secret as the password, joined with a colon and base64-encoded (Authorization: Basic <base64(client_id:client_secret)>). Tools such as curl encode the credentials for you when you pass them with --user "<client_id>:<client_secret>". Alternatively, send the credentials as the client_id and client_secret form fields in the request body. Don't use both methods in the same request.

Body

application/x-www-form-urlencoded
token
string
required

The access token to revoke.

client_id
string

The client ID of the OAuth application. Use together with client_secret as an alternative to HTTP Basic authentication.

Example:

"H3WVOKGN4B7JXQYCQ6DJFAW5ZU"

client_secret
string

The client secret of the OAuth application. Use together with client_id as an alternative to HTTP Basic authentication.

token_type_hint
enum<string>

A hint about the type of token being revoked. Optional; only access tokens are issued.

Available options:
access_token

Response

The token was revoked, or was already invalid. The response has no body.