Code in

Revoke

Ends a refresh token and every token in its line.

POST https://accounts.aton-network.org/oauth/revoke

When to use it

When somebody signs out of your app for good, or disconnects their Atheron account from it.

Authentication

The same client authentication as the token endpoint.

Parameters

Name	In	Type	Required	Limits	What it is
`token`	form	string	yes		The refresh token to end.
`token_type_hint`	form	string	no	refresh_token	Optional.

Request

# End a refresh token and every token in its line. Always answers 200 once your app is authenticated.
curl https://accounts.aton-network.org/oauth/revoke \
  -u "$ATHERON_CLIENT_ID:$ATHERON_CLIENT_SECRET" \
  -d token="$REFRESH_TOKEN" \
  -d token_type_hint=refresh_token

Response

http

HTTP 200
content-type: application/json

{}

Errors

HTTP	error	Cause	Fix
400	`invalid_request`	A parameter is missing or malformed: no PKCE, PKCE with plain, a bad max_age, prompt=none combined with another prompt, or a token request that is not form encoded.	Send every required parameter once, PKCE with S256, and form-encode the token request.
401	`invalid_client`	Your app could not be authenticated: a wrong or expired secret, a revoked or expired certificate, a bad client_assertion (aud must be the token endpoint, exp at most ten minutes ahead, jti new), a public app sending a secret, or the app is suspended.	Check the credential on the app's Credentials page and its expiry. Rotate without downtime: add a new one, deploy, then revoke the old.

Good to know

It always answers 200 once your app is authenticated, whether or not the token was real, so the answer says nothing about tokens to a guesser (RFC 7009).

Security

Revoke on sign-out from a shared device. The person's consent stays until they take it back in their account.

Ask Atlas

AI assistant

Ask anything about Sign in with Atheron, the API or the portal. You get an answer from our docs, with links to the pages it used.