Revoke Token

Immediately invalidates a specific access or refresh token by removing its Redis session entry. The token becomes unusable within milliseconds — there is no grace period.

Token types

token_type: "access" — revokes the access token. The user must refresh (if they have a valid refresh token) or re-login.

token_type: "refresh" — revokes the refresh token. The user must re-login to obtain a new token pair.

Common use cases

Terminate a specific device session (e.g. after a reported account compromise).

Revoke all tokens after a password change (call for each known token).

User-initiated logout — revoke the access token to end the session.

Terminate a session from an admin panel without the user's cooperation.

No authentication required
This endpoint does not require a Bearer token — you supply the raw token value to revoke.

Idempotent
Revoking an already-expired or already-revoked token returns a success response without error.

curl --location --request POST 'https://platform-oauth.convirza.com/oauth/revoke-token' \ --header 'Content-Type: application/json' \ --data-raw '{ "token": "abc123access456789012345678901234", "token_type": "access" }'

Request

Responses