Revoke OAuth tokens
OAuth tokens can be revoked in two ways:
Users themselves can remove the tokens for the apps they've granted permission to. To revoke:
- Sign in at accounts.zoho.com.
- Click Sessions in the left menu, then scroll down to Connected Apps.
- To revoke token for an app, hover over the app and click Revoke Access.
- Click Yes, Proceed.
Programmatically, OAuth tokens can be revoked by making a POST request to the endpoint oauth/v2/revoke/token. Both access tokens and refresh tokens can be revoked. If a refresh token is revoked, all the access tokens that are generated using it also get revoked.
Endpoint
POST {accounts-server-url}/oauth/v2/revoke/token
Note: The accounts-server-url is specific to the location (i.e., datacenter) where your app is registered.
Headers
| Header | Description |
| Authorization | required Base64-encoded credentials of your app (that is, client ID and client secret) passed with the header Basic.
Syntax: Authorization: Basic <space> {Base64Encoded(client_id:client_secret)}.
Example: Authorization: Basic MTAwMC5IVUZBV0xBO.......
If your app is a client-based application, client_secret is not required. Otherwise, client_secret is mandatory. |
Query parameters
| Parameter | Description |
| token | required Refresh token or access token that needs to be revoked. |
| token_type | required Type of the token being revoked. Accepted values: refresh_token, access_token. |
Request example
curl --location --request POST 'https://accounts.zoho.com/oauth/v2/revoke/token' \
--header 'Authorization: Basic MTAwMC5IVUZBV0xBODdXQVg2VzIyUDIwRzhXNE1aWEhNTUwNjE2ODExYTMxN2QwZGI0MTdl' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token=1000.18e983526f0ca8575ea9c53b0cd5bb58.1bd83a6f2e22c3a7e1309d96ae439cc1' \
--data-urlencode 'token_type=refresh_token'
Response
| Status Code | Description |
| 200 | The token is successfully revoked. |
| 400 Bad Request | The token passed in the request is invalid, the token_type does not match, or the token is not associated with the provided client credentials. |