---
title: /oauth2/token/revoke
description: Endpoint defined in RFC 7009 Token Revocation to revoke access tokens and refresh tokens.
component: pingam
version: 7.3
page_id: pingam:oauth2-guide:oauth2-token-revoke-endpoint
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-oauth2/oauth2-token-revoke-endpoint.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["OAuth 2.0", "Scopes", "Grant Flow", "Endpoints", "Setup & Configuration"]
page_aliases: ["varlist-oauth2-token-revoke-endpoint.adoc"]
---

# /oauth2/token/revoke

Endpoint defined in RFC 7009 [Token Revocation](https://www.rfc-editor.org/info/rfc7009) to revoke access tokens and refresh tokens.

When you revoke a refresh token, you revoke all tokens issued with the same authorization grant. If you obtained multiple access tokens for a single user with different authorization grants, you must revoke the tokens separately to invalidate each one.

Specify the realm in the request URL; for example:

```none
https://openam.example.com:8443/openam/oauth2/realms/root/realms/alpha/token/revoke
```

The revoke token endpoint supports the following parameters:

| Parameter               | Description                                                                                                      | Required                                                                           |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| `client_assertion`      | A signed JSON Web Token (JWT) to use as client credentials.                                                      | Yes, for [JWT profile](client-auth-jwt.html) authentication                        |
| `client_assertion_type` | The type of assertion, `client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer`. | Yes, for [JWT profile](client-auth-jwt.html) authentication                        |
| `client_id`             | Uniquely identifies the application making the request.                                                          | Yes                                                                                |
| `client_secret`         | The password for a confidential client.                                                                          | Yes, when authenticating with [Form parameters (HTTP POST)](client-auth-form.html) |
| `token`                 | The access token or refresh token to revoke.                                                                     | Yes                                                                                |

The following example revokes a refresh token:

```bash
$ curl \
--request POST \
--user "myClient:forgerock" \
--data "client_id=myClient" \
--data "token=<refresh-token>" \
"https://openam.example.com:8443/openam/oauth2/realms/root/realms/alpha/token/revoke"
{}
```