Revocation #

Any token can be invalidated before it expires.

OAuth token revocation (RFC 7009) #

Clients revoke their own tokens at the standard revocation endpoint. Revoking a refresh token also revokes the access tokens issued with it.

curl --request POST 'https://auth.microbooks.io/oauth/revoke' \
--data-urlencode 'token=<refresh or access token>' \
--data-urlencode 'token_type_hint=refresh_token' \
--data-urlencode 'client_id=<your client id>'

The endpoint always returns 200 OK — per the RFC it does not disclose whether the token existed. Confidential clients also send client_secret.

Personal access tokens #

Revoke from the dashboard (Developers → API tokens → Revoke) or over the API:

curl --request DELETE 'https://api.microbooks.io/auth/v1/tokens/<token id>' \
--header 'Authorization: Bearer <bearer_token>'

Revocation propagates to the resource APIs immediately — a revoked token gets 401 Unauthorized even though its JWT signature is still valid.

Signing out #

The first-party logout endpoint revokes the access token used to call it together with its refresh token.