---
title: /oauth2/token/revoke
description: Endpoint defined in RFC7009 - Token Revocation, used to revoke both access and refresh tokens.
component: pingam
version: 7.2
page_id: pingam:oauth2-guide:varlist-oauth2-token-revoke-endpoint
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-oauth2/oauth2-token-revoke-endpoint.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
---

# /oauth2/token/revoke

Endpoint defined in [RFC7009 - Token Revocation](https://www.rfc-editor.org/info/rfc7009), used to revoke both access and refresh tokens.

Revoking a refresh token also revokes any other associated tokens that were issued with the same authorization grant. If a client has multiple access tokens for a single user that were obtained using different authorization grants, the client would need to make multiple calls to the revoke token endpoint to invalidate each token.

The revoke token endpoint supports the following parameters:

* `token`

  Specifies the token ID that will be revoked.

  Required: Yes.

* `client_id`

  Specifies the client ID unique to the application making the request.

  Required: Yes.

* `client_secret`

  Specifies the password of the private client making the request. Do not use in conjunction with the `cnf_key` parameter.

  Required: A form of password or credentials is required for confidential clients. However, the use of the `client_secret` parameter depends on the client authentication method used. For more information, see [OAuth 2.0 client authentication](oauth2-client-auth.html).

* `client_assertion`

  Specifies the signed JWT that the client uses as a credential when using the JWT bearer client authentication method.

  For more information, see [OAuth 2.0 client authentication](oauth2-client-auth.html).

  Required: Yes, when using the JWT bearer client authentication method.

* `client_assertion_type`

  Specifies the type of assertion when the client is authenticating to the authorization server using JWT bearer client authentication. Do not use with other client authentication methods.

  Set it to `urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer`.

  For more information, see [OAuth 2.0 client authentication](oauth2-client-auth.html).

  Required: Yes, when using the JWT bearer client authentication method.

You must compose the path to the revoke token endpoint addressing the specific realm where the user code was issued. For example, `https://openam.example.com:8443/openam/oauth2/realms/root/realms/alpha/token/revoke`.

The following is an example of how to revoke a given token:

```bash
$ curl \
--request POST \
--data "token=xS3UjtuXMu77iNzl2XibpeMlw1g" \
--data "client_id=myClient" \
--data "client_secret=forgerock" \
"https://openam.example.com:8443/openam/oauth2/realms/root/realms/alpha/token/revoke"
{}
```