Skip to main content

Revoke access token

POST 
/token.revoke

Permanently revoke the presented OAuth access token and its refresh token. After a successful response the grant is dead — refresh will not resurrect it; the client must re-authorize.

This does not uninstall your app from the workspace, delete webhook subscriptions, or affect other users' tokens. For install removal see the app.uninstalled event (fired from admin / Dev Settings uninstall paths, not from this endpoint).

On success Roam also delivers a token.revoked webhook to your subscriptions (reason: "api_revoked"), including to the same app that called this endpoint. Treat that delivery as idempotent.

Subsequent API calls with the revoked access token return HTTP 401 with invalid_token (the token row is gone). Distinct from token_revoked, which signals an archived person or archived client while a credential may still exist.

This operation is only valid for OAuth access tokens, not for API keys.

Access: Organization and Personal (OAuth access tokens only). Personal tokens may revoke their own grant. API keys cannot use this endpoint.

No specific scope required.

OpenAPI Spec: chat-v1.json

Responses​

Token successfully revoked