Revocation endpoint

POST

/api/oauth/revoke

RFC 7009 token revocation. Public and unauthenticated: a bearer token
IS the credential (§2.1 explicitly allows a public client to call this
without further authentication). Accepts either an access or a
refresh token, and revokes the whole GRANT that token belongs to, as
§2.1 asks: every access and refresh token descended from the same
authorization, across every rotation. Revoking an access token
therefore also kills the refresh token that could have minted a
replacement. It stops at that grant — a separate authorization by the
same user for the same client is untouched.

Per §2.2, the response is IDENTICAL (200, empty body) whether the
token existed, was already revoked, or never existed at all: telling
those apart would turn this endpoint into an oracle for probing which
tokens are live. Only a structurally malformed request (no token
field) gets a different response.

Request

Authorization

API Key

Add parameter in header

x-api-key

Example:

x-api-key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/x-www-form-urlencodedRequired

Responses

🟢200OK

The grant was revoked, was already revoked/unknown, or never existed; all three look identical.

Headers

This response does not have a body.

🟠400Bad Request

🟠429

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://upload.tf/api/v1/api/oauth/revoke' \
--header 'x-api-key: <api-key>' \
--data-urlencode 'token='

Response Example

400 - Success Example

{
    "error": "invalid_request",
    "error_description": "\"token\" is required"
}

Modified at 2026-08-18 09:08:46

Token endpoint

MCP endpoint