Revoke a refresh token
POST
/oauth/revoke
const url = 'https://api.nsin.ir/oauth/revoke';const options = { method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: new URLSearchParams({token: 'example', client_id: 'example', client_secret: 'example'})};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.nsin.ir/oauth/revoke \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data token=example \ --data client_id=example \ --data client_secret=exampleRevokes a refresh token and every token rotated from the same login — this is what a relying party calls on sign-out. Access tokens are short lived and are not tracked; they stop working when they expire, or sooner if the underlying NSIN session is revoked.
Per RFC 7009 the answer is always 200, whether or not the token
existed: an error would turn this endpoint into a way to test tokens.
A confidential client must send its secret, or the request is a silent
no-op.
Request Body required
Section titled “Request Body required ”object
token
required
The refresh token to revoke.
string
client_id
required
string
client_secret
Required for confidential clients; without it the call is a silent no-op.
string
Example generated
token=example&client_id=example&client_secret=exampleobject
token
required
The refresh token to revoke.
string
client_id
required
string
client_secret
Required for confidential clients; without it the call is a silent no-op.
string
Example generated
{ "token": "example", "client_id": "example", "client_secret": "example"}Responses
Section titled “ Responses ”Always, regardless of whether anything was revoked.
Media type application/json
object
ok
boolean
Example generated
{ "ok": true}