> ## Documentation Index
> Fetch the complete documentation index at: https://partner.tren.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /oauth/revoke

> Revoke a Trench access or refresh token. Which token you send determines whether one token or the whole connection is revoked.

Revokes a token. This is how you disconnect a user from your side of the integration.

|                |                                                                                  |
| -------------- | -------------------------------------------------------------------------------- |
| **Auth**       | HTTP Basic, with your `client_id` as the username and an API key as the password |
| **Rate limit** | 30 / minute, keyed by IP                                                         |

## Request

<CodeGroup>
  ```bash cURL theme={null}
  curl -X POST 'https://api.tren.ch/oauth/revoke' \
    -u "$CLIENT_ID:$API_KEY" \
    -d token=trench_rt_…
  ```

  ```javascript Node.js theme={null}
  const basic = Buffer.from(`${CLIENT_ID}:${API_KEY}`).toString("base64");

  await fetch("https://api.tren.ch/oauth/revoke", {
    method: "POST",
    headers: {
      Authorization: `Basic ${basic}`,
      "Content-Type": "application/x-www-form-urlencoded",
    },
    body: new URLSearchParams({ token: refreshToken }),
  });
  ```

  ```python Python theme={null}
  import requests

  requests.post(
    "https://api.tren.ch/oauth/revoke",
    auth=(CLIENT_ID, API_KEY),
    data={"token": refresh_token},
  )
  ```
</CodeGroup>

| Field   | Required | Notes                                                       |
| ------- | -------- | ----------------------------------------------------------- |
| `token` | No       | An access or refresh token. Omitting it still returns `200` |

## What Gets Revoked

The type of token you send changes how much is revoked, and the difference is easy to get wrong.

| Token sent                   | Effect                                                                                      |
| ---------------------------- | ------------------------------------------------------------------------------------------- |
| Refresh token (`trench_rt_`) | Revokes the entire grant, including every access and refresh token for that user and client |
| Access token (`trench_at_`)  | Revokes only that access token, leaving the refresh token able to mint new ones             |

<Warning>
  To disconnect a user, send the refresh token. Sending the access token only forces an early refresh, and your next `grant_type=refresh_token` call will return a working pair as though nothing happened.
</Warning>

## Response

```json theme={null}
{}
```

The endpoint always returns `200`, including for tokens that are unknown, already expired, or already revoked. This is intentional, since it prevents the endpoint from being used to probe which tokens exist, but it does mean a `200` is not evidence that the token was real.

## Errors

| Status | Error                      | Cause                                                                                             |
| ------ | -------------------------- | ------------------------------------------------------------------------------------------------- |
| `401`  | `invalid_client`           | Bad or missing client credentials                                                                 |
| `429`  | `too_many_failed_attempts` | Twenty failed authentications against this `client_id` within five minutes. Carries `retry-after` |