> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chamelio.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke a Token

> Invalidate an access token or refresh token immediately

Revokes a single token. Call this when a user disconnects your integration, or whenever a token may
have been exposed.

## Endpoint

```
POST /oauth/revoke
```

## Authentication

None beyond the token itself - possession of the token is what authorizes revoking it.

## Request Body

Content type: `application/x-www-form-urlencoded`

| Parameter | Type   | Required | Description                                                    |
| --------- | ------ | -------- | -------------------------------------------------------------- |
| `token`   | string | Yes      | The token to revoke. May be an access token or a refresh token |

<Info>
  There is no `token_type_hint` parameter. Chamelio looks the value up as an access token first, then
  as a refresh token.
</Info>

## Request Example

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST "https://platform.chamelio.ai/oauth/revoke" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d "token=ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz"
  ```

  ```python Python theme={null}
  import requests

  url = "https://platform.chamelio.ai/oauth/revoke"
  data = {"token": "ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz"}

  response = requests.post(url, data=data)
  print(response.status_code)  # 200
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://platform.chamelio.ai/oauth/revoke', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded'
    },
    body: new URLSearchParams({
      token: 'ca_xYz123AbCdEfGhIjKlMnOpQrStUvWxYz'
    })
  });

  console.log(response.status); // 200
  ```
</CodeGroup>

## Response

### Success Response

**Status Code:** `200 OK`

```json theme={null}
{}
```

<Info>
  Revocation always returns `200` with an empty object, whether the token existed, was already
  revoked, or never existed at all. This follows RFC 7009 and prevents the endpoint from being used to
  test whether a token value is valid. The call is safe to retry.
</Info>

## Error Responses

### 422 Unprocessable Entity

Returned when the `token` form field is missing from the request body.

```json theme={null}
{
  "detail": [
    {
      "type": "missing",
      "loc": ["body", "token"],
      "msg": "Field required"
    }
  ]
}
```

## Notes

<Warning>
  Revoking an **access token** does not revoke its refresh token, and revoking a **refresh token**
  does not revoke the access token it belongs to. To cut off an integration completely, revoke both,
  or [delete the application](/api-reference/oauth/applications) - that revokes every token it
  ever issued.
</Warning>

<Info>
  Refreshing a token revokes the previous access and refresh token pair automatically, so you do not
  need to revoke them yourself after a rotation.
</Info>

## Use Cases

* **User disconnects your integration** - Drop the token you hold for them
* **Credential exposure** - Invalidate a token that may have leaked
* **Sign-out** - End an authorized session rather than waiting for expiry