- Mark the access token (and any associated refresh token) as revoked.
- Disable the matching plugin authorization for that creator on Kit’s side.
- Asynchronously clear any partner credentials Kit holds for that creator on your behalf.
Endpoint
Request
Content-Type: application/x-www-form-urlencoded
Body parameters
Body parameters
string
required
The Kit-issued token to revoke. Both access tokens and refresh tokens are accepted.
string
required
Your app’s Client ID.
string
required
Your app’s Client Secret.
string
Optional hint at the token type, one of
access_token or refresh_token. Speeds up the lookup. If the hint is wrong, Kit falls back to checking the other type.Code samples
Code samples
Response
200 OK on success, with an empty response body.Per RFC 7009 §2.2, the endpoint also responds with
200 OK if the token is unknown, already revoked, or expired. This is intentional and prevents token enumeration. Treat a 200 response as “the token is no longer valid”, regardless of whether it was valid before the call.