# Token revocation Invalidate the tokens and associated user authorizations for a user when they are no longer associated with your app. ## Discussion In order to revoke authorization for a user, you must obtain a valid refresh token or access token. If you don’t have either token for the user, you can generate tokens when validating an authorization code. For more information about user tokens and creating client secrets, see [`Token validation`](/documentation/SigninwithAppleRESTAPI/Generate-and-validate-tokens). To invalidate a user’s refresh token, invoke the revoke endpoint with the following HTTP POST method. ```console curl -v POST "https://appleid.apple.com/auth/revoke" \ -H 'content-type: application/x-www-form-urlencoded' \ -d 'client_id=CLIENT_ID' \ -d 'client_secret=CLIENT_SECRET' \ -d 'token=REFRESH_TOKEN' \ -d 'token_type_hint=refresh_token' ``` Additionally, to invalidate a user’s access token, use the following HTTP POST method. ```console curl -v POST "https://appleid.apple.com/auth/revoke" \ -H 'content-type: application/x-www-form-urlencoded' \ -d 'client_id=CLIENT_ID' \ -d 'client_secret=CLIENT_SECRET' \ -d 'token=ACCESS_TOKEN' \ -d 'token_type_hint=access_token' ``` For either token revocation request, the `revoke` endpoint returns a `200` response code without a response body after the server invalidates the `token` value, or if the `token` value was previously invalidated. If the response contains an error, please see [`ErrorResponse`](/documentation/SigninwithAppleRESTAPI/ErrorResponse) for the specific error code provided in the response body. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)