# Revoke access token

`POST /token.revoke`

## Description

Permanently revoke the presented OAuth access token **and its refresh
token**. After a successful response the grant is dead — refresh will not
resurrect it; the client must re-authorize.

This does **not** uninstall your app from the workspace, delete webhook
subscriptions, or affect other users' tokens. For install removal see the
[`app.uninstalled`](/docs/webhooks/app-uninstalled) event (fired from admin
/ Dev Settings uninstall paths, not from this endpoint).

On success Roam also delivers a [`token.revoked`](/docs/webhooks/token-revoked)
webhook to your subscriptions (`reason: "api_revoked"`), including to the
same app that called this endpoint. Treat that delivery as idempotent.

Subsequent API calls with the revoked access token return HTTP `401` with
`invalid_token` (the token row is gone). Distinct from `token_revoked`,
which signals an archived person or archived client while a credential may
still exist.

This operation is only valid for OAuth access tokens, not for API keys.

**Access:** Organization and Personal (OAuth access tokens only). Personal
tokens may revoke their own grant. API keys cannot use this endpoint.

**No specific scope required.**

---

**OpenAPI Spec:** [chat-v1.json](https://developer.ro.am/chat-v1.json)

## Authentication

```
Authorization: Bearer YOUR_API_KEY
```

## Responses

### 200 - Token successfully revoked

### 400 - Bad request. Common causes:
- Token is an API key (not revocable via this endpoint)


### 401 - Presented invalid authentication credentials.

### 500 - An internal error occurred.

---

*Machine-readable API documentation.*
*Full documentation: https://developer.ro.am/docs/api/token-revoke*