Sample - Plaid API
POST/oauth/revoke

Revoke an OAuth token

Revokes an OAuth access or refresh token so it can no longer be used. Revoking a refresh token also revokes access and refresh tokens derived from it, including exchanged tokens; send the request as JSON or form-encoded data.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

4 body fields

OAuth token revocation request, accepted as JSON or application/x-www-form-urlencoded data.

tokenstringrequired
An OAuth token of any type (`refresh_token`, `access_token`, etc)
client_idstringoptional
Your Plaid API `client_id`. The `client_id` is required and may be provided either in the `PLAID-CLIENT-ID` header or as part of a request body.
client_secretstringoptional
Your Plaid API `secret`. The `secret` is required and may be provided either in the `PLAID-SECRET` header or as part of a request body as either `secret` or `client_secret`.
secretstringoptional
Your Plaid API `secret`. The `secret` is required and may be provided either in the `PLAID-SECRET` header or as part of a request body as either `secret` or `client_secret`.

2 status codes
200Returns a `request_id` confirming that the OAuth token revocation request completed.
request_idstringrequired
A unique identifier for the request, which can be used for troubleshooting. This identifier, like all Plaid identifiers, is case sensitive.
defaultError response.
errorstringoptional
OAuth error code
Allowed:invalid_requestinvalid_clientinvalid_grantunauthorized_clientinvalid_scopeunsupported_grant_type
error_descriptionstringoptional
A human-readable description of the error
error_uristringoptional
A URI identifying the specific error
request_idstringrequired
A unique identifier for the request, which can be used for troubleshooting. This identifier, like all Plaid identifiers, is case sensitive.

Error handling

token is required and must be the OAuth access or refresh token to revoke. Provide client_id and the corresponding client_secret or secret through the supported request fields or authentication headers, and treat refresh-token revocation as affecting all derived tokens.