Revoke token (V2)
Invalidates a token, per RFC 7009. Call it when a user disconnects their account or signs out of your app โ it is the polite alternative to leaving a live token behind.
Revoking either token of a pair revokes both. The access token and refresh token belong to a single grant, so passing either one ends the whole thing. There is no way to drop only the access token and keep refreshing.
Always returns 200, even for a token that never existed, is already revoked, or belongs to another app. That is required by RFC 7009 so the endpoint cannot be used to probe which tokens are valid. A 200 means the token is not usable afterwards; it does not confirm that it was usable before. An app can only revoke its own tokens.
Revoking is not a substitute for the user removing your app in Connected Apps settings, but for a sign-out it is the right call.
Client authentication
Apps registered as Server apps & services must authenticate. Send the credentials either as an Authorization: Basic header (RFC 6749 section 2.3.1) or as client_id and client_secret parameters in the body. Both are accepted.
Mobile, desktop & browser apps and TV, devices & command line registrations have no secret and send only client_id.
Client authentication is checked before the grant is looked at, and a failure is 401 invalid_client, not 400. If a server app omits its secret it gets invalid_client no matter what else is wrong with the request, which can mask a second problem behind it.
Body format
Both application/x-www-form-urlencoded (the RFC 6749 section 3.2 default) and application/json are accepted. Every parameter must be a plain string. Sending an array or object for any parameter returns 400 invalid_request naming the offending parameter.
Every /oauth2/* response is sent with Cache-Control: no-store and Pragma: no-cache. Do not cache these responses, including the errors.
Body
The access or refresh token to revoke.
Optional and ignored -- the token's own prefix already identifies its type. Accepted for RFC 7009 compliance so that libraries which always send it are not broken by it.
access_token, refresh_token Response
The token is not usable. Returned whether or not it ever was.