haunt.gg | Revoke

Invalidate a token you no longer need — when a user signs out of your app, when you rotate credentials, or when you suspect a token leaked. Follows RFC 7009.

POST/api/auth/oauth2/revoke

This revokes your app's token. It does not disconnect the app from the user's account — the user's approval stays, so the next authorization request skips the consent screen. Users disconnect apps themselves under Account → Settings → Connections, which also deletes every token your app holds for them.

Authorizations

Authorizationheaderstring

Basic base64(client_id:client_secret). Alternatively send both as form fields.

client_idbodystring

Your app's client ID, if you are not using the Basic header.

client_secretbodystring

Your app's secret. Client authentication is required.

Body

The body must be application/x-www-form-urlencoded.

tokenbodystringrequired

The access token or refresh token to revoke.

token_type_hintbodystring

access_token or refresh_token. Only a hint — the endpoint looks the token up either way.

Example Request

Request

curl -X POST "https://haunt.gg/api/auth/oauth2/revoke" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d "token=YOUR_REFRESH_TOKEN" \
  -d "token_type_hint=refresh_token"

Response

Done. As RFC 7009 requires, an unknown, already-revoked or foreign token is not an error — the response is a success either way, so revocation is safely idempotent.

null

Rate limit

100 requests per minute per IP address, counted for this endpoint alone.