Skip to main content
An Access Token can be revoked at any time by either sending the Access Token or Refresh Token the endpoint. 
curl -i -X POST "https://api.box.com/oauth2/revoke" \
     -H "content-type: application/x-www-form-urlencoded" \
     -d "client_id=[CLIENT_ID]" \
     -d "client_secret=[CLIENT_SECRET]" \
     -d "token=[ACCESS_TOKEN]"

await auth.revokeTokens();
// client's tokens have been revoked

client.auth.revoke_token()

await auth.RevokeTokenAsync();

try await auth.revokeToken()

auth.revokeToken();
// client's tokens have been revoked

oauth.revoke()

client.revokeTokens("<TOKEN>")
	.then(() => {
		// the client's access token have been revoked
	});
Usage in SDKsAll of the Box SDKs support manually revoking the current Access Token associated with the client. To revoke a specific token, first initialize a new SDK with that token and then call the relevant revoke method.
Last modified on March 19, 2026