Revoke a Token

Revokes a single token. Call this when a user disconnects your integration, or whenever a token may have been exposed.

Endpoint

POST /oauth/revoke

Authentication

None beyond the token itself - possession of the token is what authorizes revoking it.

Request Body

Content type: application/x-www-form-urlencoded

Parameter	Type	Required	Description
`token`	string	Yes	The token to revoke. May be an access token or a refresh token

There is no token_type_hint parameter. Chamelio looks the value up as an access token first, then as a refresh token.

Request Example

curl -X POST "https://platform.chamelio.ai/oauth/revoke" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz"

import requests

url = "https://platform.chamelio.ai/oauth/revoke"
data = {"token": "ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz"}

response = requests.post(url, data=data)
print(response.status_code)  # 200

const response = await fetch('https://platform.chamelio.ai/oauth/revoke', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded'
  },
  body: new URLSearchParams({
    token: 'ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz'
  })
});

console.log(response.status); // 200

Response

Success Response

Status Code: 200 OK

{}

Revocation always returns 200 with an empty object, whether the token existed, was already revoked, or never existed at all. This follows RFC 7009 and prevents the endpoint from being used to test whether a token value is valid. The call is safe to retry.

Error Responses

422 Unprocessable Entity

Returned when the token form field is missing from the request body.

{
  "detail": [
    {
      "type": "missing",
      "loc": ["body", "token"],
      "msg": "Field required"
    }
  ]
}

Notes

Revoking an access token does not revoke its refresh token, and revoking a refresh token does not revoke the access token it belongs to. To cut off an integration completely, revoke both, or delete the application - that revokes every token it ever issued.

Refreshing a token revokes the previous access and refresh token pair automatically, so you do not need to revoke them yourself after a rotation.

Use Cases

User disconnects your integration - Drop the token you hold for them
Credential exposure - Invalidate a token that may have leaked
Sign-out - End an authorized session rather than waiting for expiry

Overview

API Key Access

OAuth App Access

Webhooks

Endpoint

Authentication

Request Body

Request Example

Response

Success Response

Error Responses

422 Unprocessable Entity

Notes

Use Cases

​Endpoint

​Authentication

​Request Body

​Request Example

​Response

​Success Response

​Error Responses

​422 Unprocessable Entity

​Notes

​Use Cases

Endpoint

Authentication

Request Body

Request Example

Response

Success Response

Error Responses

422 Unprocessable Entity

Notes

Use Cases