OAuth2 token revocation (RFC 7009)
A client-authenticated request revokes the presented token (and its whole rotation family). Always returns 200 for an authenticated client — even for an unknown token — so it never leaks token existence. A failed client authentication is 401 invalid_client. Use this when… the CLIENT itself wants to revoke ONE token it holds (standard RFC 7009). To disconnect a client entirely and revoke ALL of an org’s tokens for it from the dashboard, an org owner uses oauthRevokeConnection instead.
Authorizations
Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.
Body
Response
The token was revoked (or did not exist).