Revoke an application's tokens

POST /v1/applications/{application_id}/tokens:revoke · permission sessions:write

Revokes every active refresh token family issued to the application, for all users. Access tokens issued to the application before the call stop being accepted by introspection and the revocation check. Use it when tokens issued to the application may have leaked: the application must obtain new tokens through a new authorization request.

Sessions, users' consents and the application's credentials are not changed: users' sign-in sessions stay open, so a new authorization request can succeed without signing in again, and consent is not asked again. To stop a leaked client secret from minting new tokens, also rotate the application's credentials. The request has no body. A repeated call succeeds with a zero count. The revocation is written to the management audit log. Send an Idempotency-Key header to make retries safe.

Request

Parameter	In	Required	Description
`application_id`	path	yes	Application id, prefixed `app_`.

Response

200 OK.

{
  "revoked_token_families": 318
}

revoked_token_families is the number of refresh token families revoked by this call.

Errors

Every error is an application/problem+json body with a stable code.

HTTP	`code`	When
400	`malformed_request`, `unknown_field`	A body was sent and it is not an empty JSON object.
404	`not_found`	The application does not exist in this environment.
401	`unauthenticated`	The API key is missing, invalid or revoked.
403	`insufficient_permissions`	The key lacks the `sessions:write` permission.
429	`rate_limited`	The rate limit was exceeded; honor `Retry-After`.
503	`service_unavailable`	A dependency is temporarily unavailable; retry later.

Example

curl -X POST https://api.eu.keenauth.com/v1/applications/app_0a1b2c3d4e5f6g7h8j9k0m1n2p/tokens:revoke \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)"

CLI: keenauth applications tokens revoke app_0a1b2c3d4e5f6g7h8j9k0m1n2p --yes