# How do a token revoke?

**URL:** <https://devforum.okta.com/t/how-do-a-token-revoke/13966>\
**Category:** Questions\
**Created:** [April 26, 2021, 3:05pm UTC](https://devforum.okta.com/t/how-do-a-token-revoke/13966 "2021-04-26T15:05:01Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [April 26, 2021, 5:42pm UTC](https://devforum.okta.com/t/how-do-a-token-revoke/13966/2 "2021-04-26T17:42:00Z")

</div>

As noted in [our documentation](https://developer.okta.com/docs/reference/api/oidc/#revoke), client authentication is required in order to revoke a user’s access or refresh tokens. The format for your client authentication (as you are using PKCE auth) will be different than it would be if you had a client secret, doc’d [here](https://developer.okta.com/docs/reference/api/oidc/#none).

For any endpoint that specifies client authentication is required, including /revoke, PKCE apps will need to include the client\_id in the body of the request instead of supplying a clientId: clientSecret authorization header. See example [here](https://devforum.okta.com/t/revoke-token-with-pkce-logout/5364/2).

---

_[View the full topic](https://devforum.okta.com/t/how-do-a-token-revoke/13966)._