Revoke a Refresh Token

Token Revocation

Check the RFC7009 for a detailed description. Revoke a refresh token when your application no longer needs it. A revocation request invalidates the refresh token. It is not possible to revoke an access token. After a refresh token has been revoked, access tokens issued before stay valid until they expire. Access tokens expire after one hour at the latest.

Revoke a Refresh Token

The client builds the request by including the following parameters using the “application/x-www-form-urlencoded” format in an HTTP request entity-body:

POST https://account.ezeep.com/oauth/revoke/

Supported attributes:

Attribute	Type	Required	Description
`Authorization`	HTTP Header	Yes	Basic {{base_64_encoded_client_id}} for public clients, Basic {{base_64_encoded_client_id_and_secret}} for confidential clients
`Content-Type`	HTTP Header	Yes	`application/x-www-form-urlencoded`
`token`	string	Yes	`The refresh token to be revoked`

If successful, returns HTTP status code 200 OK without any content.

Example Request

curl -L -X POST "https://account.ezeep.com/oauth/revoke/" \
     --header "Authorization: Basic <base64_encoded_client_id>" \
     --header "Content-Type: application/x-www-form-urlencoded" \
     --data-urlencode "token=O1dtH4rqejCzPS2uRYnt"

Example Response

HTTP/1.1 200 OK