curl --request POST 'https://api.voicecheap.ai/oauth/revoke' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token=mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE' \
--data-urlencode 'client_id=mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
--data-urlencode 'token_type_hint=refresh_token'
const input = {
token: 'mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE',
client_id: 'mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
token_type_hint: 'refresh_token',
};
const response = await fetch('https://api.voicecheap.ai/oauth/revoke', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams(input),
redirect: 'manual',
});
console.log(response.status, await response.text());
import os
import requests
response = requests.request(
"POST",
"https://api.voicecheap.ai/oauth/revoke",
headers={"Content-Type":"application/x-www-form-urlencoded"},
data={"token": "mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE", "client_id": "mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "token_type_hint": "refresh_token"},
timeout=120,
allow_redirects=False,
)
print(response.status_code, response.text)
OAuth and MCP protocol
Revoke an MCP OAuth connection
Revoke a connection using one of its access or refresh tokens and the registered client_id.
POST
/
oauth
/
revoke
curl --request POST 'https://api.voicecheap.ai/oauth/revoke' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token=mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE' \
--data-urlencode 'client_id=mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
--data-urlencode 'token_type_hint=refresh_token'
const input = {
token: 'mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE',
client_id: 'mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
token_type_hint: 'refresh_token',
};
const response = await fetch('https://api.voicecheap.ai/oauth/revoke', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams(input),
redirect: 'manual',
});
console.log(response.status, await response.text());
import os
import requests
response = requests.request(
"POST",
"https://api.voicecheap.ai/oauth/revoke",
headers={"Content-Type":"application/x-www-form-urlencoded"},
data={"token": "mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE", "client_id": "mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "token_type_hint": "refresh_token"},
timeout=120,
allow_redirects=False,
)
print(response.status_code, response.text)
Revoke a connection using one of its access or refresh tokens and the registered client_id.
POST https://api.voicecheap.ai/oauth/revoke
Authentication
No client secret. Send token and client_id in the URL-encoded form body.Request body
string
required
An issued MCP access or refresh token. Unknown token strings are accepted without revealing whether a token exists.Minimum length: 1. Maximum length: 256. Pattern:
^[^\u0000-\u001F\u007F]+$.string
required
The client_id associated with the token. A missing or malformed scalar is rejected; an unknown or mismatched client returns success.Minimum length: 1. Maximum length: 2048. Pattern:
^[^\u0000-\u001F\u007F]+$.field
Optional standard hint. This implementation ignores this field and does not validate its value; token prefixes determine the token family.
Technical schema
Technical schema
{
"type": "object",
"properties": {
"token": {
"type": "string",
"minLength": 1,
"maxLength": 256,
"pattern": "^[^\\u0000-\\u001F\\u007F]+$",
"description": "An issued MCP access or refresh token. Unknown token strings are accepted without revealing whether a token exists."
},
"client_id": {
"type": "string",
"minLength": 1,
"maxLength": 2048,
"pattern": "^[^\\u0000-\\u001F\\u007F]+$",
"description": "The client_id associated with the token. A missing or malformed scalar is rejected; an unknown or mismatched client returns success."
},
"token_type_hint": {
"description": "Optional standard hint. This implementation ignores this field and does not validate its value; token prefixes determine the token family."
}
},
"required": [
"token",
"client_id"
],
"additionalProperties": true
}
Request examples
Follow the documented encoding and authentication for this route. The action API’s envelope and idempotency rules apply only to action invocations.curl --request POST 'https://api.voicecheap.ai/oauth/revoke' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token=mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE' \
--data-urlencode 'client_id=mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
--data-urlencode 'token_type_hint=refresh_token'
const input = {
token: 'mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE',
client_id: 'mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
token_type_hint: 'refresh_token',
};
const response = await fetch('https://api.voicecheap.ai/oauth/revoke', {
method: 'POST',
headers: {
'Content-Type': 'application/x-www-form-urlencoded',
},
body: new URLSearchParams(input),
redirect: 'manual',
});
console.log(response.status, await response.text());
import os
import requests
response = requests.request(
"POST",
"https://api.voicecheap.ai/oauth/revoke",
headers={"Content-Type":"application/x-www-form-urlencoded"},
data={"token": "mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE", "client_id": "mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "token_type_hint": "refresh_token"},
timeout=120,
allow_redirects=False,
)
print(response.status_code, response.text)
Response
An empty JSON object. Unknown tokens, wrong client associations, and already revoked connections also return HTTP 200.HTTP 200
{}
Response headers
{
"Cache-Control": "no-store",
"Pragma": "no-cache"
}
Operation notes
- Recognized scalar parameters must be supplied once as nonempty strings without ASCII control characters or DEL. Repeated query/form fields decode to arrays and are rejected when read as scalars.
- Use application/x-www-form-urlencoded. JSON requests are rejected with invalid_request.
- Revoking either a recognized access token or refresh token revokes the entire connection and clears its active refresh token; it is not limited to the one supplied token.
- The resource parameter is not required or checked on this route. token_type_hint and other unrecognized fields are ignored.
- The endpoint does not first fetch a client registration. A well-formed unknown client_id, a wrong client_id for the token, or an unknown token returns {} without revealing token validity.
- The public revocation limit is 60 requests per minute per client IP, shared across workers. URL-encoded bodies are limited to 32 KiB.
- The client_id returned by dynamic registration, or the exact public HTTPS URL of the client metadata document.
Errors
| HTTP status | Code | Meaning or recovery |
|---|---|---|
| 400 | invalid_request | The body or a recognized parameter is invalid, missing, duplicated, or has the wrong encoding. |
| 413 | REQUEST_TOO_LARGE | The request exceeds the allowed body size. JSON is limited to 1 MiB and URL-encoded forms to 32 KiB. |
| 415 | UNSUPPORTED_CONTENT_TYPE | The integration body parser accepts JSON or URL-encoded forms only. The route may require one of those encodings specifically. |
| 429 | temporarily_unavailable | The public OAuth request rate limit was reached. Wait for the current window before retrying. |
| 500 | server_error | Authorization is temporarily unavailable. Retry later. |
Was this page helpful?