> ## Documentation Index
> Fetch the complete documentation index at: https://api-docs.voicecheap.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke an MCP OAuth connection

> Revoke a connection using one of its access or refresh tokens and the registered client_id.

Revoke a connection using one of its access or refresh tokens and the registered client\_id.

```http theme={null}
POST https://api.voicecheap.ai/oauth/revoke
```

## Authentication

No client secret. Send token and client\_id in the URL-encoded form body.

## Request body

<ParamField body="token" type="string" required>
  An issued MCP access or refresh token. Unknown token strings are accepted without revealing whether a token exists.

  Minimum length: 1. Maximum length: 256. Pattern: `^[^\u0000-\u001F\u007F]+$`.
</ParamField>

<ParamField body="client_id" type="string" required>
  The client\_id associated with the token. A missing or malformed scalar is rejected; an unknown or mismatched client returns success.

  Minimum length: 1. Maximum length: 2048. Pattern: `^[^\u0000-\u001F\u007F]+$`.
</ParamField>

<ParamField body="token_type_hint" type="field">
  Optional standard hint. This implementation ignores this field and does not validate its value; token prefixes determine the token family.
</ParamField>

<Accordion title="Technical schema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "token": {
        "type": "string",
        "minLength": 1,
        "maxLength": 256,
        "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
        "description": "An issued MCP access or refresh token. Unknown token strings are accepted without revealing whether a token exists."
      },
      "client_id": {
        "type": "string",
        "minLength": 1,
        "maxLength": 2048,
        "pattern": "^[^\\u0000-\\u001F\\u007F]+$",
        "description": "The client_id associated with the token. A missing or malformed scalar is rejected; an unknown or mismatched client returns success."
      },
      "token_type_hint": {
        "description": "Optional standard hint. This implementation ignores this field and does not validate its value; token prefixes determine the token family."
      }
    },
    "required": [
      "token",
      "client_id"
    ],
    "additionalProperties": true
  }
  ```
</Accordion>

## Request examples

Follow the documented encoding and authentication for this route. The action API's envelope and idempotency rules apply only to action invocations.

<RequestExample>
  ```bash cURL theme={null}
  curl --request POST 'https://api.voicecheap.ai/oauth/revoke' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --data-urlencode 'token=mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE' \
    --data-urlencode 'client_id=mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' \
    --data-urlencode 'token_type_hint=refresh_token'
  ```

  ```javascript JavaScript theme={null}
  const input = {
    token: 'mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE',
    client_id: 'mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
    token_type_hint: 'refresh_token',
  };
  const response = await fetch('https://api.voicecheap.ai/oauth/revoke', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: new URLSearchParams(input),
    redirect: 'manual',
  });
  console.log(response.status, await response.text());
  ```

  ```python Python theme={null}
  import os
  import requests

  response = requests.request(
      "POST",
      "https://api.voicecheap.ai/oauth/revoke",
      headers={"Content-Type":"application/x-www-form-urlencoded"},
      data={"token": "mcp_refresh_EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE", "client_id": "mcp_client_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "token_type_hint": "refresh_token"},
      timeout=120,
      allow_redirects=False,
  )
  print(response.status_code, response.text)
  ```
</RequestExample>

## Response

An empty JSON object. Unknown tokens, wrong client associations, and already revoked connections also return HTTP 200.

```json HTTP 200 theme={null}
{}
```

## Response headers

```json theme={null}
{
  "Cache-Control": "no-store",
  "Pragma": "no-cache"
}
```

## Operation notes

* Recognized scalar parameters must be supplied once as nonempty strings without ASCII control characters or DEL. Repeated query/form fields decode to arrays and are rejected when read as scalars.
* Use application/x-www-form-urlencoded. JSON requests are rejected with invalid\_request.
* Revoking either a recognized access token or refresh token revokes the entire connection and clears its active refresh token; it is not limited to the one supplied token.
* The resource parameter is not required or checked on this route. token\_type\_hint and other unrecognized fields are ignored.
* The endpoint does not first fetch a client registration. A well-formed unknown client\_id, a wrong client\_id for the token, or an unknown token returns \{} without revealing token validity.
* The public revocation limit is 60 requests per minute per client IP, shared across workers. URL-encoded bodies are limited to 32 KiB.
* The client\_id returned by dynamic registration, or the exact public HTTPS URL of the client metadata document.

## Errors

| HTTP status | Code | Meaning or recovery |
| - | - | - |
| 400 | `invalid_request` | The body or a recognized parameter is invalid, missing, duplicated, or has the wrong encoding. |
| 413 | `REQUEST_TOO_LARGE` | The request exceeds the allowed body size. JSON is limited to 1 MiB and URL-encoded forms to 32 KiB. |
| 415 | `UNSUPPORTED_CONTENT_TYPE` | The integration body parser accepts JSON or URL-encoded forms only. The route may require one of those encodings specifically. |
| 429 | `temporarily_unavailable` | The public OAuth request rate limit was reached. Wait for the current window before retrying. |
| 500 | `server_error` | Authorization is temporarily unavailable. Retry later. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.