oauth.net
Token Revocation
Token Revocation gives clients a way to tell the authorization server that a token is no longer needed so it can be immediately invalidated, enabling clean logout and limiting the window of exposure for a compromised token.
When to use this
Call the revocation endpoint when a user logs out, when a client no longer needs access, or when you detect a token may be compromised. Revoke both the access token and refresh token if you have both. Note that revocation only guarantees the authorization server won't issue new tokens from the revoked refresh token — resource servers using JWT access tokens won't know about the revocation until the JWT expires.
Revocation is a simple POST to the revocation endpoint with the token value and optionally a token_type_hint (access_token or refresh_token). The server responds with 200 regardless of whether the token was valid — this prevents token fishing.
Related specs
More resources
- Revoking Access (oauth.com)