Overview
When an access token (or refresh token) is invalidated using Authlete/auth/revocation API, the corresponding refresh token (or access token) will be invalidated at the same time.How Authlete handles token revocation requests
On receiving a revocation request form a client, an authorization server will call Authlete’s /auth/revocation API with “parameters” parameter that contains content of the revocation request. The revocation request from the client contains the following parameters as defined in RFC 7009.| parameter | Required | value |
|---|---|---|
| token | yes | The token that the client wants to get revoked. |
| token_type_hint | no | A hint about the type of the token submitted for revocation. |
| token_type_hint | how to locate the token record | invalidation |
|---|---|---|
| (none) | look up the access token records first, and refresh token records next. | both access and refresh tokens |
| access_token | same as above | same as above |
| refresh_token | look up the refresh token records first, and access token records next. | same as above |