POST /oauth/revoke - Trench

Revokes a token. This is how you disconnect a user from your side of the integration.


Auth	HTTP Basic, with your `client_id` as the username and an API key as the password
Rate limit	30 / minute, keyed by IP

Request

curl -X POST 'https://api.tren.ch/oauth/revoke' \
  -u "$CLIENT_ID:$API_KEY" \
  -d token=trench_rt_…

const basic = Buffer.from(`${CLIENT_ID}:${API_KEY}`).toString("base64");

await fetch("https://api.tren.ch/oauth/revoke", {
  method: "POST",
  headers: {
    Authorization: `Basic ${basic}`,
    "Content-Type": "application/x-www-form-urlencoded",
  },
  body: new URLSearchParams({ token: refreshToken }),
});

import requests

requests.post(
  "https://api.tren.ch/oauth/revoke",
  auth=(CLIENT_ID, API_KEY),
  data={"token": refresh_token},
)

Field	Required	Notes
`token`	No	An access or refresh token. Omitting it still returns `200`

What Gets Revoked

The type of token you send changes how much is revoked, and the difference is easy to get wrong.

Token sent	Effect
Refresh token (`trench_rt_`)	Revokes the entire grant, including every access and refresh token for that user and client
Access token (`trench_at_`)	Revokes only that access token, leaving the refresh token able to mint new ones

To disconnect a user, send the refresh token. Sending the access token only forces an early refresh, and your next grant_type=refresh_token call will return a working pair as though nothing happened.

Response

{}

The endpoint always returns 200, including for tokens that are unknown, already expired, or already revoked. This is intentional, since it prevents the endpoint from being used to probe which tokens exist, but it does mean a 200 is not evidence that the token was real.

Errors

Status	Error	Cause
`401`	`invalid_client`	Bad or missing client credentials
`429`	`too_many_failed_attempts`	Twenty failed authentications against this `client_id` within five minutes. Carries `retry-after`

⌘I