# How to revoke OAuth token generated from OAuth2 plugin **URL:** \ **Category:** Questions\ **Created:** [December 18, 2017, 5:43am UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246 "2017-12-18T05:43:30Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![shiva2991](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/shiva2991/32/95_2.png) [@shiva2991](https://discuss.konghq.com/u/shiva2991)\ **Post date:** [December 18, 2017, 5:43am UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/1 "2017-12-18T05:43:30Z")
Hi, I can not find any API for revoking access token in OAuth2 plugin documentation. How can I do that? Thanks, Shiva ---
**Author:** ![kikito](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/kikito/32/15_2.png) [@kikito](https://discuss.konghq.com/u/kikito)\ **Post date:** [December 18, 2017, 11:48am UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/2 "2017-12-18T11:48:36Z")
Hello, Please try this request: ``` curl -X DELETE http://kong:8001/oauth2_tokens/ ``` It should remove the token from the database. I have [created an issue](https://github.com/Kong/getkong.org/issues/567) to include those endpoints in the docs, thanks for reporting this and apologies if this has caused you any trouble. ---
**Author:** ![shiva2991](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/shiva2991/32/95_2.png) [@shiva2991](https://discuss.konghq.com/u/shiva2991)\ **Post date:** [December 18, 2017, 11:54am UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/3 "2017-12-18T11:54:57Z")
Thank you very much, It worked. ---
**Author:** ![shiva2991](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/shiva2991/32/95_2.png) [@shiva2991](https://discuss.konghq.com/u/shiva2991)\ **Post date:** [December 19, 2017, 10:15am UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/4 "2017-12-19T10:15:04Z")
Is it possible to delete multiple tokens in single request? ---
**Author:** ![kikito](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/kikito/32/15_2.png) [@kikito](https://discuss.konghq.com/u/kikito)\ **Post date:** [December 19, 2017, 11:26am UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/5 "2017-12-19T11:26:27Z")
No, the endpoint only allows 1 token UUID per request. ---
**Author:** ![pointcom](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/pointcom/32/84_2.png) [@pointcom](https://discuss.konghq.com/u/pointcom)\ **Post date:** [January 9, 2018, 10:37am UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/6 "2018-01-09T10:37:08Z")
I don’t get why Kong doesn’t provide a revoke endpoint. It should be its responsibility. @kikito Your example would work but I would say for debugging purpose it would be better to flag revoked tokens instead. Kong could use a `revoked_at` field in its db for example to store the date when the client revoked his token. ---
**Author:** ![kikito](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/kikito/32/15_2.png) [@kikito](https://discuss.konghq.com/u/kikito)\ **Post date:** [January 9, 2018, 1:16pm UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/7 "2018-01-09T13:16:44Z")
The resources we have as a company aren’t unlimited. Probably we’ll end up doing what you suggest, but right now other developments are more prioritary to us. If it’s important for you, can I suggest sending us a PR? That would accelerate the process. ---
**Author:** ![bungle](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/bungle/32/13_2.png) [@bungle](https://discuss.konghq.com/u/bungle)\ **Post date:** [January 10, 2018, 12:45pm UTC](https://discuss.konghq.com/t/how-to-revoke-oauth-token-generated-from-oauth2-plugin/246/8 "2018-01-10T12:45:35Z")
There are a lot of standards in OAuth 2.0 space, such as Revocation that is not part of the base standard, but defined in another: [https://tools.ietf.org/html/rfc7009](https://tools.ietf.org/html/rfc7009). There is almost no upper limit what your Identity Provider could have. Though, I agree Revocation and Introspection endpoints would be nice to have in our plugin, but it could also have support for OpenID Connect, JWT tokens (both JWS/JWE maybe), etc. We do provide in our EE version of the product a very full featured OpenID Connect Relying Party Plugin that you can use to integrate with some big-player identity solutions (there are also a third party plugin here: [https://github.com/nokia/kong-oidc](https://github.com/nokia/kong-oidc)), such as Google, Microsoft, Okta, PingFederate, OneLogin, Auth0, Yahoo!, SalesForce, Paypal, Connect2id, IdentityServer4, OpenAM, Gluu, Keycloak, Dex, to mention a few. But as long as your identity provider supports OpenID Connect standard you can integerate with it. All that said, I think revocation is high on the list of what should be in OAuth 2.0 Plugin. We are happy to receive a pull-request for it.