Token revoked
Webhook
Fires when an OAuth access token belonging to your app is revoked by any
path: the user, an admin, your own token.revoke call, or SCIM user
deactivation.
Event name: token.revoked
Delivered inside the standard event envelope;
the schema below shows the full delivery body with this event's payload
under data.
Delivery is authenticated by your webhook signing secret — not by the
revoked token — so you still receive this event after the grant is gone.
You may also receive it for a token you no longer hold (for example after
calling token.revoke yourself); treat handling as idempotent.
This event does not mean the app was uninstalled. Webhook subscriptions
and other users' tokens are untouched unless a separate uninstall path
also runs. See app.uninstalled.
Required scope: webhook:write (the same scope needed to subscribe).
Request
Responses
- 200
Return a 200 status to acknowledge receipt of the event