OAuth
Revoke Token
RFC 7009: revoke an access or refresh token and the rest of its family. Always 200 (also for an unknown token).
API key access
This route has its own authentication (or none); an API key is not used here.
POST
/api/v1/oauth/revoketokenstring
token_type_hint?string | null
client_id?string | null
Response Body
curl -X POST "http://localhost:8000/api/v1/oauth/revoke" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'token=string'Empty
{
"error": "string",
"error_description": "string"
}Register Client
RFC 7591 dynamic client registration of a public client (no secret). Rate-limited per client IP (`OAUTH_REGISTER_RATE_LIMIT_PER_HOUR`); at most `OAUTH_MAX_CLIENTS` are kept (unused clients are evicted first, else 503).
Token
`authorization_code` (with the PKCE verifier; a code works once, a second use revokes what the first issued) and `refresh_token` (rotation: the old refresh token stops; presenting it again revokes the whole family). Access tokens last `OAUTH_ACCESS_TOKEN_TTL_SECONDS` (default 1 hour), refresh tokens `OAUTH_REFRESH_TOKEN_TTL_DAYS` (default 30).