Revoke an access token or refresh token

POSThttps://merchant.shuttleglobal.com/revoke

Language

Credentials

Client IDClient secret

Remember on this device

Kept in this browser tab unless you tick Remember; don't on a shared computer. Use keys from a sandbox account to test without moving money.

Parameters

Body application/x-www-form-urlencoded

cURL request

curl --request POST \
  --url https://merchant.shuttleglobal.com/revoke \
  --header 'Authorization: Basic <base64 of CLIENT_ID:CLIENT_SECRET>'

const url = 'https://merchant.shuttleglobal.com/revoke';
const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>'}
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "https://merchant.shuttleglobal.com/revoke"

headers = {"Authorization": "Basic <base64 of CLIENT_ID:CLIENT_SECRET>"}

response = requests.post(url, headers=headers)

print(response.json())

<?php

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://merchant.shuttleglobal.com/revoke', [
  'headers' => [
    'Authorization' => 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>',
  ],
]);

echo $response->getBody();

require 'uri'
require 'net/http'

url = URI("https://merchant.shuttleglobal.com/revoke")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>'

response = http.request(request)
puts response.read_body

package main

import (
  "fmt"
  "net/http"
  "io"
)

func main() {

  url := "https://merchant.shuttleglobal.com/revoke"

  req, _ := http.NewRequest("POST", url, nil)

  req.Header.Add("Authorization", "Basic <base64 of CLIENT_ID:CLIENT_SECRET>")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

Response

Token successfully revoked

No response body.

POST

/revoke

Authenticate your client in one of two ways:

In the request body, with the client_id and client_secret parameters, or
With HTTP Basic authentication, using your client_id as the username and your client_secret as the password

Use one method per request, not both. If you put client_id or client_secret in the body, put both there.

Invalidates either an access token or refresh token. Use this endpoint when:

A user logs out
A token may have been compromised
You want to clean up unused tokens

Authorizations

clientAuth
None

Request Body^required

application/x-www-form-urlencoded

object

token

required

string

The token to revoke (either an access_token or refresh_token)

token_type_hint

string · enum

Optional hint about the type of token being revoked

Allowed values: access_token refresh_token

client_id

string

Your client ID. Required unless you send it with HTTP Basic authentication.

client_secret

string

Your client secret. Required unless you send it with HTTP Basic authentication.

Responses

200

Token successfully revoked

400

Invalid token format

401

Invalid client credentials

Was this page helpful?

Revoke an access token or refresh token

Authorizations

Request Bodyrequired

Responses

200

400

401

Request Body^required