Revoke Token

Revoke an access token or refresh token. Follows RFC 7009.

No authentication required. This is a public endpoint.

Request example

123456curl -X POST https://api.v2.dealmachine.com/v1/oauth/revoke \
  -H "Content-Type: application/json" \
  -d '{
    "token": "dm_at_live_xxx",
    "token_type_hint": "access_token"
  }'

Response example

123{
  "revoked": true
}

Request Body

Field	Type	Required	Description
`token`	string	Yes	The token to revoke
`token_type_hint`	string	No	`access_token` or `refresh_token` (helps server find token faster)

Cascade Behavior

Revoking an access token also revokes its associated refresh tokens
Revoking a refresh token also revokes its associated access token

Always revoke tokens when a user signs out or when you no longer need access. This is a security best practice.