Token Revocation

Revokes an active access token or refresh token, as specified by RFC 7009. This endpoint is idempotent — it always returns 200 OK even if the token does not exist or was already revoked.

When a refresh token is revoked, all access tokens in the same family are also invalidated. Revoking an access token does not automatically revoke the associated refresh token.

Confidential clients authenticate via HTTP Basic or body params. Public clients send only client_id.

curl -X POST "https://api.whatalo.com/oauth/revoke" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'token=LKr5XU5xyiD0XscBPSO9tm0DsSK2AKsWL2fOe9an6v8'

{
  "error": "invalid_client",
  "error_description": "Client authentication failed"
}