# Initiate revoke by Resource Owner

**URL:** <https://devforum.okta.com/t/initiate-revoke-by-resource-owner/19805>\
**Category:** Questions\
**Created:** [March 14, 2022, 7:26pm UTC](https://devforum.okta.com/t/initiate-revoke-by-resource-owner/19805 "2022-03-14T19:26:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![weithu](https://avatars.discourse-cdn.com/v4/letter/w/f05b48/32.png) [@weithu](https://devforum.okta.com/u/weithu)\
**Post date:** [March 14, 2022, 7:26pm UTC](https://devforum.okta.com/t/initiate-revoke-by-resource-owner/19805/1 "2022-03-14T19:26:09Z")

</div>

Hi,  
We have a client A which obtains access and refresh tokens via the Authorization Code Flow. We want to allow the resource owner to have the ability to revoke any tokens that have already been issued.

I found the /revoke endpoint which appears to do what I want: Revoking refresh tokens will automatically invalid corresponding access tokens which is great. However when testing this it appears that I will need to use Client A’s clientId and clientSecret in order to do this. The documentation says

> **[OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#revoke)**
>
> Find information about the OAuth 2.0 and OpenID Connect endpoints that Okta exposes on its authorization servers.

> “A client may only revoke its own tokens”

That line seems to suggest that only clientA can initiate /revoke. Is there another method to achieve revocation of clientA’s tokens initiated by the resource owner or even the resource server side?

Thanks,  
Wei

---

<div class="post-metadata">

**Author:** ![warren](https://avatars.discourse-cdn.com/v4/letter/w/97f17d/32.png) [@warren](https://devforum.okta.com/u/warren)\
**Post date:** [March 22, 2022, 5:12pm UTC](https://devforum.okta.com/t/initiate-revoke-by-resource-owner/19805/2 "2022-03-22T17:12:38Z")

</div>

I believe it is because the revoke endpoint requires client authentication. If the resource owner has access to the client id and client secret, then it can make the revoke request as well.

> **Note:** The `/revoke` endpoint requires client authentication. See the [Client authentication methods](https://developer.okta.com/docs/reference/api/oidc/#client-authentication-methods) section for more information on which method to choose and how to use the parameters in your request.

> **[OpenID Connect & OAuth 2.0 API | Okta Developer](https://developer.okta.com/docs/reference/api/oidc/#request-parameters-5)**
>
> Find information about the OAuth 2.0 and OpenID Connect endpoints that Okta exposes on its authorization servers.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 8, 2024, 9:50pm UTC](https://devforum.okta.com/t/initiate-revoke-by-resource-owner/19805/3 "2024-02-08T21:50:03Z")

</div>

Closed on February 8, 2024, 9:50pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.