Revoke and inspect OAuth tokens
Disconnect a ShareAI OAuth authorization and inspect token activity using authenticated server-to-server Auth requests.
On this page
Revoke a token#
https://auth.shareai.now/oauth/revokeInvalidate an application token.
- Base URL
https://auth.shareai.now- Authentication
- Confidential client authentication
cURL
curl --fail-with-body https://auth.shareai.now/oauth/revoke \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "client_id=$SHAREAI_CLIENT_ID" \
--data-urlencode "client_secret=$SHAREAI_CLIENT_SECRET" \
--data-urlencode "token=$SHAREAI_ACCESS_TOKEN"
When a customer disconnects ShareAI from your app, revoke the applicable credential and remove your stored tokens. Treat a successful revocation response as completion even when the supplied token was already unusable. Do not expose token values in logs or support messages.
Inspect activity#
https://auth.shareai.now/oauth/introspectCheck whether a token belonging to the client is active.
- Base URL
https://auth.shareai.now- Authentication
- Confidential client authentication
cURL
curl --fail-with-body https://auth.shareai.now/oauth/introspect \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "client_id=$SHAREAI_CLIENT_ID" \
--data-urlencode "client_secret=$SHAREAI_CLIENT_SECRET" \
--data-urlencode "token=$SHAREAI_ACCESS_TOKEN"
Inspect active before using other returned fields. Introspection describes token state at the time of the check; API authorization still applies when a subsequent request is admitted. A token from another client must not be treated as your application’s authorization.
Reconnect when consent is required#
Revoked or expired authorization can require a fresh browser authorization. Keep that flow separate from a temporary 503 service error. Repeatedly refreshing an invalid token does not restore the customer’s consent.
Last updated September 15, 2026