RFC 7009 — Token Revocation

Specification: RFC 7009

Token Revocation allows clients to invalidate access tokens and refresh tokens before they expire, supporting logout and session management flows.

Endpoint

• POST /revoke endpoint (Section 2)
• application/x-www-form-urlencoded request body

Token Types

• Refresh token revocation — invalidates the session and its associated access token
• Access token revocation — not supported (access tokens are stateless JWTs, cannot be revoked)
• Token type auto-detected by format (JWT → access token, opaque → refresh token)

Client Authentication

• Client authentication required on every request (Section 2.1)
• client_secret_basic supported
• client_secret_post supported
• invalid_client returned when authentication fails

Response Behavior

• HTTP 200 returned on success (Section 2.2)
• HTTP 200 returned for unknown/already-revoked tokens (spec: server MUST NOT indicate status)
• Client ownership check: cannot revoke another client’s token

Error Responses

• invalid_client — authentication failure
• unsupported_token_type — returned when access token revocation is attempted
• token_type_hint parameter — optional per RFC; accepted, type auto-detected by format