import { Authlete } from "@authlete/typescript-sdk";
const authlete = new Authlete({
bearer: process.env["AUTHLETE_BEARER"] ?? "",
});
async function run() {
const result = await authlete.token.management.revoke({
serviceId: "<id>",
tokenRevokeRequest: {
accessTokenIdentifier: "Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q",
},
});
console.log(result);
}
run();require 'authlete_ruby_sdk'
Models = ::Authlete::Models
s = ::Authlete::Client.new(
bearer: '<YOUR_BEARER_TOKEN_HERE>'
)
res = s.token_management.revoke(service_id: '<id>', token_revoke_request: Models::Components::TokenRevokeRequest.new(
access_token_identifier: 'Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q'
))
unless res.token_revoke_response.nil?
# handle response
endpackage main
import(
"context"
"os"
authlete "github.com/authlete/authlete-go-sdk"
"github.com/authlete/authlete-go-sdk/models/components"
"log"
)
func main() {
ctx := context.Background()
s := authlete.New(
authlete.WithSecurity(os.Getenv("AUTHLETE_BEARER")),
)
res, err := s.Token.Management.Revoke(ctx, "<id>", components.TokenRevokeRequest{
AccessTokenIdentifier: authlete.Pointer("Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q"),
})
if err != nil {
log.Fatal(err)
}
if res.TokenRevokeResponse != nil {
// handle response
}
}curl --request POST \
--url https://us.authlete.com/api/{serviceId}/auth/token/revoke \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"accessTokenIdentifier": "<string>",
"refreshTokenIdentifier": "<string>",
"clientIdentifier": "<string>",
"subject": "<string>"
}
'{
"resultCode": "A312001",
"resultMessage": "Revoked 1 access token(s).",
"count": 1
}{
"resultCode": "A001201",
"resultMessage": "[A001201] /auth/authorization, TLS must be used."
}{
"resultCode": "A001202",
"resultMessage": "[A001202] /auth/authorization, Authorization header is missing."
}{
"resultCode": "A001215",
"resultMessage": "[A001215] /auth/authorization, The client (ID = 26837717140341) is locked."
}{
"resultCode": 404,
"resultMessage": ""
}{
"resultCode": "A001311",
"resultMessage": "[A001311] /auth/authorization, Too many requests, retry after 1 seconds. (Entity: 23769878923/87122303)"
}{
"resultCode": "A001101",
"resultMessage": "[A001101] /auth/authorization, Authlete Server error."
}Revoke Access Token
Revoke an access token.
import { Authlete } from "@authlete/typescript-sdk";
const authlete = new Authlete({
bearer: process.env["AUTHLETE_BEARER"] ?? "",
});
async function run() {
const result = await authlete.token.management.revoke({
serviceId: "<id>",
tokenRevokeRequest: {
accessTokenIdentifier: "Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q",
},
});
console.log(result);
}
run();require 'authlete_ruby_sdk'
Models = ::Authlete::Models
s = ::Authlete::Client.new(
bearer: '<YOUR_BEARER_TOKEN_HERE>'
)
res = s.token_management.revoke(service_id: '<id>', token_revoke_request: Models::Components::TokenRevokeRequest.new(
access_token_identifier: 'Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q'
))
unless res.token_revoke_response.nil?
# handle response
endpackage main
import(
"context"
"os"
authlete "github.com/authlete/authlete-go-sdk"
"github.com/authlete/authlete-go-sdk/models/components"
"log"
)
func main() {
ctx := context.Background()
s := authlete.New(
authlete.WithSecurity(os.Getenv("AUTHLETE_BEARER")),
)
res, err := s.Token.Management.Revoke(ctx, "<id>", components.TokenRevokeRequest{
AccessTokenIdentifier: authlete.Pointer("Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q"),
})
if err != nil {
log.Fatal(err)
}
if res.TokenRevokeResponse != nil {
// handle response
}
}curl --request POST \
--url https://us.authlete.com/api/{serviceId}/auth/token/revoke \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"accessTokenIdentifier": "<string>",
"refreshTokenIdentifier": "<string>",
"clientIdentifier": "<string>",
"subject": "<string>"
}
'{
"resultCode": "A312001",
"resultMessage": "Revoked 1 access token(s).",
"count": 1
}{
"resultCode": "A001201",
"resultMessage": "[A001201] /auth/authorization, TLS must be used."
}{
"resultCode": "A001202",
"resultMessage": "[A001202] /auth/authorization, Authorization header is missing."
}{
"resultCode": "A001215",
"resultMessage": "[A001215] /auth/authorization, The client (ID = 26837717140341) is locked."
}{
"resultCode": 404,
"resultMessage": ""
}{
"resultCode": "A001311",
"resultMessage": "[A001311] /auth/authorization, Too many requests, retry after 1 seconds. (Entity: 23769878923/87122303)"
}{
"resultCode": "A001101",
"resultMessage": "[A001101] /auth/authorization, Authlete Server error."
}Full description
Full description
clientIdentifier only, clientIdentifier + subject, or subject only deletes at most 20 tokens per request (the default of token.revoke.count.max in ServerConfiguration.java). If the target has more than 20 tokens, the response count will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until count returns 0.Safe bulk revocation under ongoing service: the lock-then-revoke pattern
When you call/auth/token/revoke repeatedly with clientIdentifier to wipe all tokens for a client that is still serving live traffic, the following problems arise:- Each call deletes at most 20 tokens, so a loop is required.
- During the loop the client can keep issuing and refreshing tokens, so the loop may not converge, or it may collateral-delete legitimate tokens issued after the revocation started.
- For a public client whose refresh token has leaked (no
client_secretto rotate), the attacker can keep refreshing while the cleanup runs.
- Call
POST /api/client/lock_flag/update/{clientIdentifier}withclientLocked: true.
- All subsequent token-endpoint calls for this client (
authorization_code,refresh_token,client_credentials, etc.) are rejected withinvalid_client(e.g.A458101). - Existing tokens are also rejected by
/auth/introspectionwithinvalid_token(A097303: โThe client application associated with the presented access token is locked.โ). - This immediately stops the attackerโs refresh path โ including the public-client RT-leak case where there is no
client_secretto rotate.
- Call
POST /api/auth/token/revokewithclientIdentifierin a loop until the responsecountreaches 0.
- Because issuance is stopped, the loop converges deterministically.
- All existing tokens are physically deleted, eliminating any leftover leaked tokens.
- Call
POST /api/client/lock_flag/update/{clientIdentifier}withclientLocked: falseto return to normal operation.
- End users re-authenticate and receive fresh tokens.
Authorizations
Authenticate every request with a Service Access Token or Organization Token.
Set the token value in the Authorization: Bearer <token> header.
Service Access Token: Scoped to a single service. Use when automating service-level configuration or runtime flows.
Organization Token: Scoped to the organization; inherits permissions across services. Use for org-wide automation or when managing multiple services programmatically.
Both token types are issued by the Authlete console or provisioning APIs.
Path Parameters
A service ID.
Body
The identifier of an access token to revoke
The hash of an access token is recognized as an identifier as well as the access token itself.
The identifier of a refresh token to revoke.
The hash of a refresh token is recognized as an identifier as well as the refresh token itself.
The client ID of the access token to be revoked.
Both the numeric client ID and the alias are recognized as an identifier of a client.
Bulk revocation with clientIdentifier only or clientIdentifier + subject deletes at most 20 tokens per request (the default of token.revoke.count.max in ServerConfiguration.java). If the target has more than 20 tokens, the response count will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until count returns 0.
The subject of a resource owner.
Bulk revocation with clientIdentifier + subject or subject only deletes at most 20 tokens per request (the default of token.revoke.count.max in ServerConfiguration.java). If the target has more than 20 tokens, the response count will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until count returns 0.
Response
Token revoked successfully
The code which represents the result of the API call.
A short message which explains the result of the API call.
The number of tokens revoked.
If the target has more than 20 tokens, the response count will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until count returns 0.