VPNDetectionVPNDetection

Revoke

POST
/oauth/revoke

RFC 7009. Always answers 200, including for a token that was never valid - an endpoint that distinguished the two would be a way to test whether a stolen string is a live credential.

Revoking a REFRESH token ends the whole authorization and takes its access tokens with it. Revoking an access token affects only that token.

Request Body

application/x-www-form-urlencoded

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

curl -X POST "https://api.vpndetection.io/oauth/revoke" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'token=string'
{}

Token POST

Three grant types. `urn:ietf:params:oauth:grant-type:device_code` polls a device authorization. Until the person approves it answers `authorization_pending`; poll faster than `interval` and it answers `slow_down`, which means widen your interval and keep it widened. `authorization_code` exchanges a code from `/oauth/authorize`, with the `code_verifier` matching the challenge you sent and the same `redirect_uri`. A code works once: presenting it again also revokes what the first exchange issued. `refresh_token` exchanges a refresh token. The presented token is consumed whatever happens next, so store the new one before using it. Presenting a consumed refresh token again ends the whole authorization, since it means the token was copied.