Revoke a token

POST/oauth/revoke

Revokes an OAuth token (RFC 7009). Revoking an access token ends that token. Revoking a refresh token ends the whole connection: every token it issued stops working, and the app disappears from the person's Connected apps. Call it when someone signs out of Chartnaut in your app.

Scope	Heavy call	Long poll	CLI
None, no key	No	No	None

Guidance

It lives at the root of https://api.chartnaut.com, not under /v1. The body is form-encoded.
Send the refresh token to disconnect for good. Sending only the access token leaves the refresh token able to get a new one.
It answers 200 whether or not the token existed, and ignores a token issued to a different client_id, so it tells a caller nothing about tokens it does not hold.
An API key (cn_live_) cannot be revoked here; use Revoke the current key. The person can also end a connection with Disconnect on the Developers page. Permissions and connected apps
Limited to 60 a minute from one IP address, shared with Get a token.

Request body

application/x-www-form-urlencoded, up to 64 KB.

Field	Type	Required	Description
`token`	string	Yes	An access token (`cn_oat_`) or a refresh token (`cn_ort_`)
`token_type_hint`	string	No	Ignored: the prefix says which kind it is
`client_id`	string	No	When sent, a token issued to another client is left alone. Also accepted as the HTTP Basic user name

Response

200 with no body.

Status codes

Status	Code	Meaning
`200`	-	The token is revoked, or was never valid
`400`	`invalid_request`	No `token`
`429`	`temporarily_unavailable`	More than 60 in a minute from your IP address
`500`	`server_error`	Retry

Example request

curl https://api.chartnaut.com/oauth/revoke \
  -d token=cn_ort_XXXX \
  -d client_id=cnc_5f2a9c0e7b3d41a8e6c19f04b7d2a3e1

Example response

200 OK

400 Bad Request

{
  "error": "invalid_request",
  "error_description": "token is required."
}

From the CLI

There is no CLI command for this endpoint. chartnaut logout revokes the CLI's API key with Revoke the current key.