> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Revoke OIDC and OAuth tokens

You can revoke tokens. For example, you may want to revoke tokens if a user is an unauthorized user of the resource or a user has left your organization.

note

IDaaS automatically revokes all of a user's tokens if the user is disabled, changes their user ID, or changes their password.

When tokens are revoked, you will no longer be able to obtain the following:

- Userinfo data when presenting an OIDC access token for it.
- A new OAuth access token when presenting a refresh token for it.

note

After token revocation, the client application must reauthenticate the user to obtain a new access token.

Use the following procedures, as required:

## Revoke an individual token

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.
2. Click the name of the user. The **User Details** page appears.
3. Click the **OIDC and OAuth Tokens** tab. The **OIDC and OAuth Tokens** list appears.
4. Click Circle X icon next to the token you want to revoke. The **Revoke Tokens** dialog box appears.
5. Click **Revoke**.

The selected token is revoked.

## Revoke all tokens for a user

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.
2. Click the name of the user. The **User Details** page appears.
3. Under **Actions**, click Circle X icon next to the user whose tokens you want to revoke. The **Revoke Tokens** dialog box appears.
4. Click **Revoke**.

All tokens for that user are revoked.

## Revoke all tokens issued to an application

1. Click Menu icon **>** **Security > Applications**. The **Applications List** page appears.
2. Under **OpenID Connect and OAuth Cloud Integrations**, do one of the following:
   - Under **Actions**, click Circle X icon. The **Revoke Tokens** dialog box appears.
   - Under **Actions**, click Ellipsis Vertical icon and select **Revoke All Tokens**. The **Revoke Tokens** dialog box appears.
3. Click **Revoke**.

All tokens issued to that application are revoked.

## Revoke all tokens issued to an OAuth resource server

1. Click Menu icon **>** **Security > Authorization > APIs/URLs**. The **APIs/URLs List** page appears.
2. Under **Actions**, click Circle X icon next to the resource server. The **Revoke Tokens** dialog box appears.
3. Click **Revoke**.

All tokens issued to that OAuth resource server are revoked.

warning

Revoking all tokens for an application or resource server can interrupt active sessions and API calls until tokens are reissued.