> ## Documentation Index > Fetch the complete documentation index at: https://developers.authlete.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > ### Authlete versions > Authlete 3.0 is the current version. Unless the user says they use another version, answer for Authlete 3.0 using the 3.x documentation. > Documentation for Authlete 2.x (pages under `/v2/` and `/ja/v2/`) is for the legacy version. Refer to it only when the user is on Authlete 2.x. > > ### Authlete architecture > Authlete is a backend engine for OAuth 2.0 and OpenID Connect processing. End users and client applications do not call it directly; the service provider's authorization server and API server call Authlete's APIs. Authlete handles protocol processing and token, client, and service management, while the service provider owns the OAuth/OIDC endpoints and user authentication. > See [Architecture](https://developers.authlete.com/get-started/introduction-to-authlete/architecture.md). > > ### Concepts > If the user is new to Authlete, read these pages first: > - [Request and Response](https://developers.authlete.com/get-started/concepts/request-and-response.md): Core API requests pass the client's request parameters as-is, and responses return `resultCode`, `action`, and `responseContent`. > - [Action Handling](https://developers.authlete.com/get-started/concepts/action-handling.md): Branch on `action`, never on `resultCode`, and map each action to the HTTP response your server returns. > - [Two-Step API Calls](https://developers.authlete.com/get-started/concepts/two-step-api-calls.md): Actions such as `INTERACTION` are completed with a second call (`/auth/authorization/issue` or `/auth/authorization/fail`) linked by a `ticket`. > - [Management API Overview](https://developers.authlete.com/get-started/concepts/overview.md): The Management API configures services, manages clients, and operates issued tokens, separately from the protocol flows handled by the Core API. > - [API Authentication](https://developers.authlete.com/get-started/concepts/authentication.md): Authlete APIs use bearer tokens: a Service Access Token (one service) or an Organization Token (the whole organization). # Revoke Access Token > Revoke an access token. Bulk revocation with `clientIdentifier` only, `clientIdentifier` + `subject`, or `subject` only deletes at most **20 tokens per request** (the default of `token.revoke.count.max` in `ServerConfiguration.java`). If the target has more than 20 tokens, the response `count` will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until `count` returns 0. ### Safe bulk revocation under ongoing service: the lock-then-revoke pattern When you call `/auth/token/revoke` repeatedly with `clientIdentifier` to wipe all tokens for a client that is still serving live traffic, the following problems arise: * Each call deletes at most 20 tokens, so a loop is required. * During the loop the client can keep issuing and refreshing tokens, so the loop may not converge, or it may collateral-delete legitimate tokens issued after the revocation started. * For a public client whose refresh token has leaked (no `client_secret` to rotate), the attacker can keep refreshing while the cleanup runs. The safe and reliable pattern is to **temporarily lock the client first, then revoke**. 1. Call `POST /api/client/lock_flag/update/{clientIdentifier}` with `clientLocked: true`. * All subsequent token-endpoint calls for this client (`authorization_code`, `refresh_token`, `client_credentials`, etc.) are rejected with `invalid_client` (e.g. `A458101`). * Existing tokens are also rejected by `/auth/introspection` with `invalid_token` (`A097303`: "The client application associated with the presented access token is locked."). * This immediately stops the attacker's refresh path β€” including the public-client RT-leak case where there is no `client_secret` to rotate. 2. Call `POST /api/auth/token/revoke` with `clientIdentifier` in a loop until the response `count` reaches 0. * Because issuance is stopped, the loop converges deterministically. * All existing tokens are physically deleted, eliminating any leftover leaked tokens. 3. Call `POST /api/client/lock_flag/update/{clientIdentifier}` with `clientLocked: false` to return to normal operation. * End users re-authenticate and receive fresh tokens. ## OpenAPI ````yaml https://spec.speakeasy.com/authlete/sdk-workspace/authlete-api-explorer-with-code-samples post /api/{serviceId}/auth/token/revoke openapi: 3.0.3 info: title: Authlete API description: '' version: 3.0.16 license: name: Apache 2.0 url: https://www.apache.org/licenses/LICENSE-2.0.html servers: - description: πŸ‡ΊπŸ‡Έ US Cluster url: https://us.authlete.com - description: πŸ‡―πŸ‡΅ Japan Cluster url: https://jp.authlete.com - description: πŸ‡ͺπŸ‡Ί Europe Cluster url: https://eu.authlete.com - description: πŸ‡§πŸ‡· Brazil Cluster url: https://br.authlete.com security: - bearer: [] tags: - name: Service Management description: >- API endpoints for managing services, including creation, update, and deletion of services. x-tag-expanded: false - name: Client Management description: >- API endpoints for managing OAuth clients, including creation, update, and deletion of clients. x-tag-expanded: false - name: Authorization Endpoint description: API endpoints for implementing OAuth 2.0 Authorization Endpoint. x-tag-expanded: false - name: Pushed Authorization Endpoint description: >- API endpoints for implementing OAuth 2.0 Pushed Authorization Requests (PAR). x-tag-expanded: false - name: Token Endpoint description: API endpoints for implementing OAuth 2.0 Token Endpoint. x-tag-expanded: false - name: Token Operations description: >- API endpoints for various token related operations, including creating, revoking and deleting access_tokens with specified scopes. x-tag-expanded: false - name: Introspection Endpoint description: API endpoints for implementing OAuth 2.0 Introspection Endpoint. x-tag-expanded: false - name: Revocation Endpoint description: API endpoint for implementing OAuth 2.0 Revocation Endpoint. x-tag-expanded: false - name: UserInfo Endpoint description: API endpoints for implementing OpenID Connect UserInfo Endpoint. x-tag-expanded: false - name: JWK Set Endpoint description: API endpoints for to generate JSON Web Key Set (JWKS) for a service. x-tag-expanded: false - name: Discovery Endpoint description: API endpoints for implementing OpenID Connect Discovery. x-tag-expanded: false - name: Configuration Endpoint description: API endpoint for accessing configuration settings for a service. x-tag-expanded: false - name: Dynamic Client Registration description: API endpoints for implementing OAuth 2.0 Dynamic Client Registration. x-tag-expanded: false - name: CIBA description: >- API endpoints for implementing Client-Initiated Backchannel Authentication (CIBA). x-tag-expanded: false - name: Grant Management Endpoint description: >- API endpoint for implementing OAuth 2.0 grants, including grant management actions like updating and revoking grants. x-tag-expanded: false - name: Jose Object description: API endpoints for JOSE objects. x-tag-expanded: false - name: Device Flow description: API endpoints for implementing OAuth 2.0 Device Flow x-tag-expanded: false - name: Federation Endpoint description: API endpoints for implementing OpenID Federation using Authlete. x-tag-expanded: false - name: Verifiable Credential Issuer description: >- API endpoints for implementing and running a Verifiable Credential Issuer (VCI). x-tag-expanded: false - name: Hardware Security Key description: API endpoints for managing hardware security keys (HSK). x-tag-expanded: false - name: Utility Endpoints description: API endpoints for various utility operations. x-tag-expanded: false - name: Native SSO description: API endpoints for Native SSO x-tag-expanded: false - name: Audit Logs description: >- API endpoints for retrieving audit logs, hosted on the Authlete IdP server. x-tag-expanded: false paths: /api/{serviceId}/auth/token/revoke: post: tags: - Token Operations summary: Revoke Access Token description: | Revoke an access token. operationId: auth_token_revoke_api parameters: - in: path name: serviceId description: A service ID. schema: type: string required: true requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/token_revoke_request' example: accessTokenIdentifier: Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q application/x-www-form-urlencoded: schema: $ref: '#/components/schemas/token_revoke_request' responses: '200': description: Token revoked successfully content: application/json: schema: $ref: '#/components/schemas/token_revoke_response' example: resultCode: A312001 resultMessage: Revoked 1 access token(s). count: 1 '400': $ref: '#/components/responses/400' '401': $ref: '#/components/responses/401' '403': $ref: '#/components/responses/403' '404': $ref: '#/components/responses/404' '429': $ref: '#/components/responses/429' '500': $ref: '#/components/responses/500' x-codeSamples: - lang: typescript label: Typescript (SDK) source: |- import { Authlete } from "@authlete/typescript-sdk"; const authlete = new Authlete({ bearer: process.env["AUTHLETE_BEARER"] ?? "", }); async function run() { const result = await authlete.token.management.revoke({ serviceId: "", tokenRevokeRequest: { accessTokenIdentifier: "Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q", }, }); console.log(result); } run(); - lang: ruby label: Ruby (SDK) source: >- require 'authlete_ruby_sdk' Models = ::Authlete::Models s = ::Authlete::Client.new( bearer: '' ) res = s.token_management.revoke(service_id: '', token_revoke_request: Models::Components::TokenRevokeRequest.new( access_token_identifier: 'Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q' )) unless res.token_revoke_response.nil? # handle response end - lang: go label: Go (SDK) source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tauthlete \"github.com/authlete/authlete-go-sdk\"\n\t\"github.com/authlete/authlete-go-sdk/models/components\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := authlete.New(\n authlete.WithSecurity(os.Getenv(\"AUTHLETE_BEARER\")),\n )\n\n res, err := s.Token.Management.Revoke(ctx, \"\", components.TokenRevokeRequest{\n AccessTokenIdentifier: authlete.Pointer(\"Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q\"),\n })\n if err != nil {\n log.Fatal(err)\n }\n if res.TokenRevokeResponse != nil {\n // handle response\n }\n}" x-code-samples: - lang: shell label: curl source: > curl -v -X POST https://us.authlete.com/api/21653835348762/auth/token/revoke \ -H 'Content-Type:application/json' \ -H 'Authorization: Bearer V5a40R6dWvw2gMkCOBFdZcM95q4HC0Z-T0YKD9-nR6F' \ -d '{ "accessTokenIdentifier": "Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q" }' - lang: java label: java source: > AuthleteConfiguration conf = ...; AuthleteApi api = AuthleteApiFactory.create(conf); TokenRevokeRequest req = new TokenRevokeRequest(); req.setAccessTokenIdentifier("Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q"); api.tokenRevoke(req); - lang: python source: > conf = ... api = AuthleteApiImpl(conf) req = TokenRevokeRequest() req.access_token_identifier = 'Z5a40U6dWvw2gMoCOAFbZcM85q4HC0Z--0YKD9-Nf6Q' api.token_revoke(req) components: schemas: token_revoke_request: type: object properties: accessTokenIdentifier: type: string description: > The identifier of an access token to revoke The hash of an access token is recognized as an identifier as well as the access token itself. refreshTokenIdentifier: type: string description: > The identifier of a refresh token to revoke. The hash of a refresh token is recognized as an identifier as well as the refresh token itself. clientIdentifier: type: string description: > The client ID of the access token to be revoked. Both the numeric client ID and the alias are recognized as an identifier of a client. Bulk revocation with `clientIdentifier` only or `clientIdentifier` + `subject` deletes at most **20 tokens per request** (the default of `token.revoke.count.max` in `ServerConfiguration.java`). If the target has more than 20 tokens, the response `count` will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until `count` returns 0. subject: type: string description: > The subject of a resource owner. Bulk revocation with `clientIdentifier` + `subject` or `subject` only deletes at most **20 tokens per request** (the default of `token.revoke.count.max` in `ServerConfiguration.java`). If the target has more than 20 tokens, the response `count` will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until `count` returns 0. token_revoke_response: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. count: type: integer description: > The number of tokens revoked. If the target has more than 20 tokens, the response `count` will be 20 and the remainder is left untouched. To fully wipe them, call the endpoint repeatedly until `count` returns 0. result: type: object properties: resultCode: type: string description: The code which represents the result of the API call. resultMessage: type: string description: A short message which explains the result of the API call. responses: '400': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001201 resultMessage: '[A001201] /auth/authorization, TLS must be used.' '401': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001202 resultMessage: '[A001202] /auth/authorization, Authorization header is missing.' '403': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001215 resultMessage: >- [A001215] /auth/authorization, The client (ID = 26837717140341) is locked. '404': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: 404 resultMessage: '' '429': description: The request exceeded the request rate permitted for the endpoint. headers: Retry-After: description: The number of seconds to wait before retrying the request. schema: type: integer example: 1 RateLimit-Remaining: description: The number of requests remaining in the next second. schema: type: integer example: 10 RateLimit-Reset: description: >- The number of seconds to wait before the request rate is fully replenished. schema: type: integer example: 1 content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001311 resultMessage: >- [A001311] /auth/authorization, Too many requests, retry after 1 seconds. (Entity: 23769878923/87122303) '500': description: '' content: application/json: schema: $ref: '#/components/schemas/result' example: resultCode: A001101 resultMessage: '[A001101] /auth/authorization, Authlete Server error.' securitySchemes: bearer: type: http scheme: bearer bearerFormat: JWT description: > Authenticate every request with a **Service Access Token** or **Organization Token**. Set the token value in the `Authorization: Bearer ` header. **Service Access Token**: Scoped to a single service. Use when automating service-level configuration or runtime flows. **Organization Token**: Scoped to the organization; inherits permissions across services. Use for org-wide automation or when managing multiple services programmatically. Both token types are issued by the Authlete console or provisioning APIs. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.