Skip to main content
Version 0.4Draft

Token revocation

Overview​

Token revocation lets your application explicitly invalidate a refresh or access token before it expires, via the RFC 7009 revocation endpoint.

Token revocation allows your application to explicitly invalidate a token before it expires. The LuxID revocation endpoint implements RFC 7009 - OAuth 2.0 Token Revocation (opens in a new tab).

Endpoint:

https://login.luxid.lu/mga/sps/oauth/oauth20/revoke

Method: POST

Client authentication is required. The endpoint accepts both refresh tokens and access tokens.

When to revoke tokens​

Revocation is appropriate in the following situations:

  • User-initiated logout from your application: revoke the refresh token so the user's session cannot be silently renewed after they leave.
  • Security incident: if you suspect a token has been compromised (for example, leaked in logs or intercepted), revoke it immediately.
  • Account suspension or offboarding: if your application revokes access for a user, revoke their refresh token to prevent further silent renewals.
  • Subscription changes: if your integration triggers a LuxID Subscription revoke (via the Partner API), revoke the associated tokens as well to enforce the change immediately.
  • Device or session management: if your application maintains a list of active devices or sessions, revocation should accompany removal.

LuxID revocation behaviour​

Revoking a Refresh Token​

Revoking a refresh token:

  1. Immediately invalidates the refresh token itself.
  2. Invalidates all access tokens that were derived from that refresh token.
  3. Prevents silent renewal - the next call to the Token endpoint with that refresh token returns an error.

This is the most effective form of revocation for ending a user's session in your application.

Revoking an Access Token​

Revoking an access token:

  1. Marks the access token as revoked in LuxID.
  2. Has limited practical effect for JWT access tokens because resource servers that validate JWT signatures locally will not be aware of the revocation until the token expires. The revocation is reflected in introspection responses.
  3. Does not invalidate the refresh token or other access tokens derived from the same refresh token.

Revoking access tokens is useful when you want to force re-introspection on your resource servers, or when tokens are opaque rather than JWT-based.

tip

Always revoke the refresh token when implementing logout or incident response. Revoking only the access token leaves the refresh token active.

Client authentication​

All revocation requests must be authenticated. LuxID supports the same client authentication methods as the Token endpoint:

MethodHow to supply
client_secret_basicAuthorization: Basic base64(client_id:client_secret)
client_secret_postclient_id and client_secret in the POST body

See Client credentials for your application's configured method.

Request​

POST /mga/sps/oauth/oauth20/revoke HTTP/1.1
Host: login.luxid.lu
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64(client_id:client_secret)

token=<refresh_or_access_token>&token_type_hint=refresh_token

Request parameters​

ParameterRequiredDescription
tokenYesThe token to revoke
token_type_hintNorefresh_token or access_token - helps the server find the token faster

cURL examples​

Revoking a Refresh Token​

curl -s \
  -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "your_client_id:your_client_secret" \
  -d "token=dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4...&token_type_hint=refresh_token" \
  https://login.luxid.lu/mga/sps/oauth/oauth20/revoke

Revoking an Access Token​

curl -s \
  -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "your_client_id:your_client_secret" \
  -d "token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...&token_type_hint=access_token" \
  https://login.luxid.lu/mga/sps/oauth/oauth20/revoke

Using client_secret_post​

curl -s \
  -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4..." \
  -d "token_type_hint=refresh_token" \
  -d "client_id=your_client_id" \
  -d "client_secret=your_client_secret" \
  https://login.luxid.lu/mga/sps/oauth/oauth20/revoke

Response​

Success​

HTTP/1.1 200 OK

Per RFC 7009 §2.2, a successful revocation always returns 200 OK with an empty body. This is true even if the token did not exist or was already expired - the server does not reveal whether the token was valid.

Error responses​

401 unauthorized - client authentication failed​

{
  "error": "invalid_client",
  "error_description": "Client authentication failed"
}

Resolution: verify your client_id and client_secret. Confirm the authentication method matches what is configured in the Console.

400 bad request - unsupported token type​

{
  "error": "unsupported_token_type",
  "error_description": "The token type is not supported for revocation"
}

Resolution: supply a refresh_token or access_token. ID tokens cannot be revoked via this endpoint.

400 bad request - missing token​

{
  "error": "invalid_request",
  "error_description": "The request is missing the required parameter: token"
}

Logout flow​

A complete application logout involves several steps beyond token revocation. The recommended sequence is:

After revoking the refresh token:

  1. Clear all session state in your application (session cookie, stored tokens, user state).
  2. Token revocation invalidates this Application's tokens for this user - it does not terminate the user's LuxID session. The user remains signed in to LuxID at login.luxid.lu and may still be silently re-authenticated by other LuxID Partners. If the user explicitly wants to end the LuxID session, redirect them to https://login.luxid.lu/auth/logout?client_id=<your-client-id> (LuxID does not expose an OIDC end_session_endpoint). See Session management and Single Sign-On.

Revocation and the LuxID data model​

A LuxID Subscription represents the ongoing relationship between a user and your application. Token revocation operates at the token layer; Subscription revocation operates at the data layer:

ActionTokensSubscriptionUser data
Revoke refresh tokenInvalidatedStill activeUnchanged
Revoke access tokenInvalidatedStill activeUnchanged
Revoke Subscription (via Partner API)All tokens invalidatedTerminatedConsent withdrawn

Token revocation alone does not terminate the Subscription or withdraw consent. The user will be asked to consent again on the next sign-in flow. Subscription revocation (via the Partner API) terminates the relationship entirely.

Integration checklist​

  • Always revoke the refresh token (not just the access token) when the user logs out of your application.
  • Clear local session state (cookies, storage) after revoking, before redirecting.
  • Handle 200 OK idempotently - do not treat it as confirmation that the token was previously valid.
  • A subscription.revoked event to detect user-initiated revocation is planned for the Event Hub (not emitted today, which emits only ClaimValuesChanged); until it ships, detect revocation from the invalid_grant returned on the next token call.
  • For security incidents, revoke the refresh token immediately and consider triggering a full re-authentication flow.
  • Do not attempt to revoke ID tokens - they are not accepted by the revocation endpoint.
Updated 2026-07-03
On this page