curl --fail-with-body --max-time 30 -X POST 'https://app.reflections.ai/oauth/revoke' \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode 'token=rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj' \
--data-urlencode 'token_type_hint=refresh_token' \
--data-urlencode 'client_id=cl_ra8t5tsberxpax0351jdyqgrb7'import { exit } from "node:process";
const response = await fetch("https://app.reflections.ai/oauth/revoke", {
method: "POST",
headers: {
"Content-Type": "application/x-www-form-urlencoded",
},
body: new URLSearchParams({
"token": "rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj",
"token_type_hint": "refresh_token",
"client_id": "cl_ra8t5tsberxpax0351jdyqgrb7"
}),
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
from urllib.error import HTTPError
from urllib.parse import urlencode
from urllib.request import Request, urlopen
headers = {
"Content-Type": "application/x-www-form-urlencoded",
}
data = urlencode({
"token": "rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj",
"token_type_hint": "refresh_token",
"client_id": "cl_ra8t5tsberxpax0351jdyqgrb7",
}).encode("utf-8")
request = Request("https://app.reflections.ai/oauth/revoke",
method="POST", headers=headers, data=data)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"net/url"
"strings"
"time"
)
func main() {
form := url.Values{
"token": {"rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj"},
"token_type_hint": {"refresh_token"},
"client_id": {"cl_ra8t5tsberxpax0351jdyqgrb7"},
}
body := strings.NewReader(form.Encode())
request, err := http.NewRequest("POST", "https://app.reflections.ai/oauth/revoke", body)
if err != nil {
panic(err)
}
request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"error": "invalid_request",
"error_description": "token is required."
}{
"error": "invalid_client",
"error_description": "Client authentication failed."
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Revoke a token
Planned contract — unavailable in test and live modes. This operation is a protocol reference, not a callable endpoint. Start with the working sandbox quickstart.
Revokes an access or refresh token, as OAuth Token Revocation (RFC 7009) defines. Call it
when the person signs out of your client. Revoking a refresh token also revokes every
access token issued from it. The response is 200 whether or not the token was valid, so
a retry is always safe.
A person can also remove a client from their account settings, which revokes its tokens at once.
Revocation takes no key. A public client sends its client_id in the body; a confidential
client authenticates with its client ID and secret.
curl --fail-with-body --max-time 30 -X POST 'https://app.reflections.ai/oauth/revoke' \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode 'token=rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj' \
--data-urlencode 'token_type_hint=refresh_token' \
--data-urlencode 'client_id=cl_ra8t5tsberxpax0351jdyqgrb7'import { exit } from "node:process";
const response = await fetch("https://app.reflections.ai/oauth/revoke", {
method: "POST",
headers: {
"Content-Type": "application/x-www-form-urlencoded",
},
body: new URLSearchParams({
"token": "rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj",
"token_type_hint": "refresh_token",
"client_id": "cl_ra8t5tsberxpax0351jdyqgrb7"
}),
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
from urllib.error import HTTPError
from urllib.parse import urlencode
from urllib.request import Request, urlopen
headers = {
"Content-Type": "application/x-www-form-urlencoded",
}
data = urlencode({
"token": "rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj",
"token_type_hint": "refresh_token",
"client_id": "cl_ra8t5tsberxpax0351jdyqgrb7",
}).encode("utf-8")
request = Request("https://app.reflections.ai/oauth/revoke",
method="POST", headers=headers, data=data)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"net/url"
"strings"
"time"
)
func main() {
form := url.Values{
"token": {"rrt_Hq2Lw7Vb4Nc9Xk1Mz6Tr3Ys8Pd5Gf0Aj"},
"token_type_hint": {"refresh_token"},
"client_id": {"cl_ra8t5tsberxpax0351jdyqgrb7"},
}
body := strings.NewReader(form.Encode())
request, err := http.NewRequest("POST", "https://app.reflections.ai/oauth/revoke", body)
if err != nil {
panic(err)
}
request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"error": "invalid_request",
"error_description": "token is required."
}{
"error": "invalid_client",
"error_description": "Client authentication failed."
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Authorizations
A confidential OAuth client's client_id and client_secret, sent as HTTP Basic
credentials. Register the client with your secret key to receive them; see
POST /oauth/register.
Body
A revocation request, as RFC 7009 defines it.
Response
The token is revoked, or was not valid. The body is empty.