Skip to content

Revoke a Human Session

Invalidate a human API session explicitly instead of waiting for the access token to expire.

Best for CLI user and API client Updated April 3, 2026
API In this interface
4 steps Steps
2 interfaces Available in
Use this path when

Call the revoke endpoint with the bearer access token, the refresh token, or both.

What you'll finish here
  • Invalidate a session deliberately.
  • Clear local credentials after revocation.
  • Avoid mixing session revocation with PAT rotation.

Where this happens

LabelValueNotes
EndpointPOST /api/v1/auth/revokeRevokes a human API session.

Same Task, Other Interfaces

Use the version that matches where you are working now. The subject matter stays the same; the delivery changes by surface.

Keep this boundary clear

  • Use PAT revocation for personal API keys and secret rotation for workspace automations. Do not use session revoke for those credential types.

Do the work

  1. 1. Send the current bearer access token in the `Authorization` header when available.
  2. 2. Include the `refreshToken` in the request body when you still have it.
  3. 3. Wait for the success response before clearing local auth state.
  4. 4. Delete locally cached session tokens immediately after a successful revoke.

Keep Going in Sign In and Sessions

Stay in the same interface and move to the next closest task in this topic when needed.

Nearby Guides

These guides stay close to the current workflow so you can keep moving without restarting discovery.