Revoking OAuth Tokens

When a user logs out of an app, or the app times out or in other ways becomes invalid, the logged-in users’ credentials are cleared from the mobile app. This effectively ends the connection to the server. Also, Mobile SDK revokes the refresh token from the server as part of logout.

Revoke Tokens with a POST Request

To revoke OAuth 2.0 tokens, use the revocation endpoint.

https://{MyDomainName}.my.salesforce.com/services/oauth2/revoke

Construct a POST request that uses the application/x-www-form-urlencoded format in the HTTP request entity-body. For example:

1POST /revoke HTTP/1.1
2    Host: https://MYDOMAINNAME.my.salesforce.com/services/oauth2/revoke
3    Content-Type: application/x-www-form-urlencoded
4
5    token=CURRENTTOKEN

If an access token is included, Salesforce invalidates it and revokes the token. If a refresh token is included, Salesforce revokes it and any associated access tokens.

Salesforce indicates successful processing of the request by returning an HTTP 200 status code. For all error conditions, Salesforce returns a 400 status code along with one of the following error responses.

unsupported_token_type—Token type not supported
invalid_token—Token was invalid

For a sandbox, use _MyDomainName_--_SandboxName_.sandbox.my.salesforce.com instead of _MyDomainName_.my.salesforce.com.

We've Moved

Welcome to the new home of the Mobile SDK Developer Guide! For now, the Japanese guide can be found in PDF form.