Token revocation

Revocation and sign-out

On sign-out, stop using the local access token and clear your session. Revoke platform authorization through its supported endpoint with required permissions. Deleting a local token does not guarantee server-side authorizations are revoked.

Check request fields, credentials and scopes in API Reference before calling revocation. Do not invent an unauthenticated revoke endpoint or log tokens. Handle subsequent 401 and reauthorize when needed rather than retrying old credentials.

See user authorization and errors and retries.