---
schema_version: "1"
id: 1d4fc62460a49d145d5997ffe6f6abe44bdfc5bd48ed2fdeb3f66fe53a010ce1
title: Revoke OAuth Tokens Programmatically
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_revoke_token.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_revoke_token.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c915053e3d59e34563b362dbb141b5e4ccb4a9f3bbc3c08ff2630807c874e18d
description: Revoke an OAuth token if you don’t want a client to access Salesforce data or if you don’t trust the client to discontinue access on its own.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Revoke OAuth Tokens Programmatically

Revoke an OAuth token if you don’t want a client to access Salesforce data or if you don’t trust the client to discontinue access on its own.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

After a client—via a connected app or external client app—receives an access or refresh token from an OAuth 2.0 authorization flow, it can use the token to access data. You can revoke the app’s access token, or the refresh token and all related access tokens, using revocation. Developers can revoke the token when configuring a log-out button in their app.

Use one of these methods to revoke a connected app or external client app's access or refresh tokens. These methods are supported for opaque tokens and JSON Web Token (JWT)-based access tokens. To revoke a Data Cloud access token, see [Revoke Data Cloud Access Tokens](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_revoke_dc_token.htm&release=264.0.0&type=5 "Revoke a Data Cloud access token to remove client access to Salesforce Data Cloud data.").

## Revoke Tokens with a POST Request

To revoke OAuth 2.0 tokens, use the revocation endpoint.

```
https://MyDomainName.my.salesforce.com/services/oauth2/revoke
```

Construct a POST request that uses the `application/x-www-form-urlencoded` format in the HTTP request entity-body. For example, use this request format to revoke opaque tokens and named user JWT-based access tokens.

```
    POST /services/oauth2/revoke HTTP/1.1
                    Host: https://MyDomainName.my.salesforce.com
                    Content-Type: application/x-www-form-urlencoded
                    
                    token=currenttoken
```

To revoke a JWT-based access token issued to a guest user, there are some extra headers. Include an `Auth-Request-Type` header with the value `guest` and a `Uvid-Hint` header with the guest user's unique visitor ID (UVID). Here's an example request to revoke a guest JWT-based access token.

```
POST /services/oauth2/revoke? HTTP 1.1
Host:https://MyDomainName.my.salesforce.com
Content-Type: application/x-www-form-urlencoded
Auth-Request-Type: guest
Uvid-Hint: <UVID value>

token=currenttoken
```

If an opaque or JWT-based access token is included, Salesforce invalidates it and revokes the token. If a refresh token is included, Salesforce revokes it and any associated access tokens. If a delete token is included, Salesforce queries it and revokes the refresh token and associated access tokens.

Salesforce indicates successful processing of the request by returning an HTTP 200 status code. For all error conditions, Salesforce returns a 400 status code along with one of these error responses.

- `unsupported_token_type`—Token type not supported
- `invalid_token`—Token was invalid

For a sandbox, use MyDomainName\--SandboxName.sandbox.my.salesforce.com instead of MyDomainName.my.salesforce.com.

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_tip.png)

Tip You can find your org’s My Domain login URL on the My Domain Setup page.

## Revoke Tokens with JSONP

The Salesforce revocation endpoint accepts GET requests with an additional callback parameter and returns the response with content type `application/javascript`. For example:

```
https://MyDomainName.my.salesforce.com/services/oauth2/revoke?token=XXXXX&callback=myCallback
```

If the request is successful, a callback is sent to the JavaScript function set in the callback parameter of the GET.

```
myCallback({});
```

If the response isn’t successful, a callback is sent with an error code.

```
myCallback({"error":"invalid_token"});
```

## Revoke Tokens with Apex

To revoke tokens with Apex, use the `revokeToken(type, AuthToken)` method in the `Auth.OauthToken` class. See the [OauthToken Class](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_Auth_OauthToken_class.htm) in the Apex Reference Guide.

#### See Also

- [OAuth Tokens and Scopes](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_tokens_scopes.htm&release=264.0.0&type=5 "OAuth tokens authorize access to protected resources. Connected apps receive tokens on behalf of a client after authorization. Scopes further define the type of protected resources that the connected app can access. You assign scopes to a connected app when you build it, and they’re included with the OAuth tokens during the authorization flow.")