Clerk API (unofficial showcase)
POST/m2m_tokens/{m2m_token_id}/revoke

Revoke an M2M token

Revokes a stored opaque-format M2M token. Use m2m_token_id to identify the token and optionally provide a revocation_reason. JWT-format M2M tokens are stateless and cannot be revoked; a Machine Secret Key can revoke only tokens managed by its machine, while a Clerk Secret Key can revoke any token in the instance.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

1 parameter · 1 body field
m2m_token_idstringrequired
Identifier of the M2M token to revoke. Must match `mt_` followed by 32 hexadecimal characters.

Optional details for revoking the M2M token.

revocation_reasonstringoptional
Reason for revoking the token.

3 status codes
200Returns the revoked M2M token object, including its identifier, subject, revocation status and reason, and timestamps.
objectstringrequired
Allowed:machine_to_machine_token
idstringrequired
subjectstringrequired
claimsunknownoptional
scopesarray<string>optional
Default:[]
revokedbooleanrequired
revocation_reasonstringrequired
expiredbooleanrequired
expirationnumberrequired
The timestamp for when the token will expire, in milliseconds
last_used_atnumberrequired
The timestamp for when the token was last used, in milliseconds
created_atnumberrequired
The timestamp for when the token was created, in milliseconds
updated_atnumberrequired
The timestamp for when the token was last updated, in milliseconds
400Returned when the request or token identifier is invalid.
errorsarray<object>required
404Returned when the specified stored token cannot be found.
errorsarray<object>required

Error handling

A 400 is returned when the request is invalid, and a 404 when the token cannot be found. The m2m_token_id path parameter must match mt_ followed by 32 hexadecimal characters. Only stored opaque-format tokens can be revoked.