Token revocation

If a user wants to revoke their consent, the TPP is responsible for revoking the refresh token.

Revocation endpoint: POST https://auth.openbanking.prod.lunar.app/oauth2/revoke

This endpoint follows the OAuth2 revocation endpoint specification (RFC 7009) and is listed in the .well-known OpenID configuration .

Token types

You can revoke both access and refresh tokens:

Access tokens: Immediately invalidate API access.
Refresh tokens: Prevent future token renewal.

To completely revoke a user’s consent, revoke the refresh token.

Example request


curl \
  -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "your-client-id:your-client-secret" \
  -d "token=<REFRESH_TOKEN>&token_type_hint=refresh_token" \
  https://auth.openbanking.prod.lunar.app/oauth2/revoke

Response

A successful revocation returns HTTP 200 with an empty response body. The token is immediately invalidated and cannot be used for further API calls.