Revoke credentials without confusing revocation with expiry.
The OAuth 2.0 Token Revocation standard lets a client ask the authorization server to revoke a refresh or access token. The practical effect depends on token type, grant relationships, and how resource servers learn that access changed.
Why this lesson?
A user disconnects an application. The client revokes its refresh capability, and protected application programming interfaces (APIs) need a clear plan for when related access stops.
Learning goal and prerequisites
Send a revocation request
The client posts the token to the authorization server’s revocation endpoint and authenticates as required for that client. token_type_hint can help the server look up the token, but it is only a hint.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Access and refresh tokens normally have lifetimes, but sometimes the system needs to end a token before that lifetime expires. A user may sign out, an administrator may disable a client, or a refresh token may be suspected of theft. OAuth token revocation gives clients a standard way to ask the authorization server to invalidate a token.
The client sends the token to the revocation endpoint and authenticates when required. The authorization server invalidates the token if it can identify it and may also invalidate related tokens according to its policy. The endpoint is designed so callers do not learn unnecessary information about whether an arbitrary token existed.
Revocation is especially important for refresh tokens because they can be used to obtain new access tokens. Revoking a refresh token can stop future renewal even when already issued access tokens remain valid until their short expiration time.
Revocation does not guarantee that every resource server instantly forgets a self-contained access token. Systems that need immediate status checks may use introspection or other stateful controls. Token lifetimes, revocation, and logout should therefore be designed together rather than treated as the same action.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.