Revoke a token
POST/oauth/revoke
RFC 7009, client-authenticated like the token endpoint. Only your app's own tokens are touched:
a krt_… refresh token revokes its whole family and every access token it minted. When that was
the grant the install runs on — no usable refresh token is left — the install moves to
reauth_required (the app must be reconnected) and its webhook hears integration.disconnected
with reason: revoked; revoking an earlier grant after a reconnect, or a family already dead,
changes nothing else. A kat_… access token revokes just that token. Anything else — another
app's token, a personal pat_… token, junk — is answered exactly like a success, so the
endpoint cannot be used to learn whether a token exists.
Throttles: oauth/revoke/client (60 a minute per client and IP) and oauth/revoke/ip (120 a
minute per IP).
Request
Responses
- 200
- 400
- 401
- 429
Revoked, or nothing to revoke. Empty body.
Response Headers
Every OAuth answer — a token response cached by a proxy is a leaked token (RFC 6749 §5.1).
invalid_request — token missing, or credentials sent two ways or in the query.
invalid_client — client authentication failed.
Response Headers
A throttle refused the request. Wait Retry-After seconds — the time left in the refusing window
plus 0–3 s of jitter. The X-RateLimit-* headers describe the bucket that refused it.
Response Headers
Seconds until the window rolls.