Revoke a refresh token

posthttps://api.nsin.ir/oauth/revoke

No authentication.

Revokes a refresh token and every token rotated from the same login — this is what a relying party calls on sign-out. Access tokens are short lived and are not tracked; they stop working when they expire, or sooner if the underlying NSIN session is revoked.

Per RFC 7009 the answer is always 200, whether or not the token existed: an error would turn this endpoint into a way to test tokens. A confidential client must send its secret, or the request is a silent no-op.

Request body

Content type: application/x-www-form-urlencoded · required

tokenstringrequired

The refresh token to revoke.
client_idstringrequired
client_secretstring

Required for confidential clients; without it the call is a silent no-op.

Content type: application/json · required

tokenstringrequired

The refresh token to revoke.
client_idstringrequired
client_secretstring

Required for confidential clients; without it the call is a silent no-op.

Responses

200Always, regardless of whether anything was revoked.

Content type: application/json

okboolean

json

{
  "ok": true
}

Example request

bash

curl -X POST "https://api.nsin.ir/oauth/revoke" \
  -H "Authorization: Bearer $NSIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "token": "string",
  "client_id": "string",
  "client_secret": "string"
}'