Revoke tokens and inspect server-side authorization
Revoke unused access and refresh tokens. Confidential integrations can also inspect token state.
POST
https://auth.shareai.now/oauth/revoke- Base URL
https://auth.shareai.now- Authentication
- Public client ID, or confidential client credentials
cURL
curl --fail-with-body 'https://auth.shareai.now/oauth/revoke' --data-urlencode "client_id=$SHAREAI_CLIENT_ID" --data-urlencode "token=$REFRESH_TOKEN"
Public clients may revoke their tokens without a secret. They cannot use the introspection or server-side agreement-administration endpoints. Confidential integrations authenticate with their private client credentials.
POST
https://auth.shareai.now/oauth/introspect- Base URL
https://auth.shareai.now- Authentication
- Confidential client credentials
Use the protected endpoint’s authorization result as the final decision. Revocation or a required new consent can invalidate a token even if its original expiry has not elapsed. Never expose a confidential secret to obtain introspection in a public application.
Last updated September 18, 2026