Revoke Token

RFC 7009 token revocation. Revoking a refresh token revokes the entire grant: every access and refresh token issued under it stops working.

Access tokens can't be revoked individually. Revoke the grant's refresh token instead. Per RFC 7009, this endpoint always returns 200 with an empty body.

Confidential clients must authenticate the same way they do at the token endpoint, using client_secret_basic or client_secret_post. Public clients (none) send only client_id.

• token (string, required) — The refresh token to revoke.

• client_id (string) — Required, except with client_secret_basic, where the Authorization header already carries it.

• client_secret (string) — Required for a confidential client using client_secret_post. Omit for public clients and for client_secret_basic (send the secret in the Authorization header instead).

• token_type_hint (string) — Optional per RFC 7009. If set to "access_token", the request fails: access token revocation isn't supported. Any other value (including "refresh_token") is accepted and ignored. Unknown hints don't affect behavior.

curl -X POST 'https://api.resend.com/oauth/revoke' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d 'client_id=550e8400-e29b-41d4-a716-446655440000&token=JcL7aYfE7S9h3L4qv0o2e1w8m6n5b3x9RkP2tD4uV6Q&token_type_hint=refresh_token'

curl -X POST 'https://api.resend.com/oauth/revoke' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -u '550e8400-e29b-41d4-a716-446655440000:CLIENT_SECRET' \
     -d 'token=JcL7aYfE7S9h3L4qv0o2e1w8m6n5b3x9RkP2tD4uV6Q&token_type_hint=refresh_token'

curl -X POST 'https://api.resend.com/oauth/revoke' \
     -H 'Content-Type: application/x-www-form-urlencoded' \
     -d 'client_id=550e8400-e29b-41d4-a716-446655440000&client_secret=CLIENT_SECRET&token=JcL7aYfE7S9h3L4qv0o2e1w8m6n5b3x9RkP2tD4uV6Q&token_type_hint=refresh_token'

HTTP/1.1 200 OK