Token management

Token revocation and security best practices.

Revoke token

Revoke an access or refresh token. Always returns 200 OK regardless of whether the token existed (RFC 7009 §2.2).

HTTP

Request

POST https://auth.enbox.net/revoke
Content-Type: application/x-www-form-urlencoded

token=access-token-xyz
&client_id=myapp-client-id

Body parameters

Parameter	Type	Required	Description
`token`	`string`	✅	The access or refresh token to revoke
`client_id`	`string`	✅	The application’s Client ID

Response

{
  "status": "revoked"
}

Behavior

Token type	What happens
Access token	Deleted from Redis immediately — next API request returns `401`
Refresh token	Marked `revoked_at` in PostgreSQL + linked access token deleted from Redis

Note: Revoking a refresh token also deletes the associated access token. The client application will receive 401 on the next API request and invalid_grant on the next refresh attempt.

Error responses

{
  "error": "invalid_request",
  "error_description": "Missing required parameter: 'token'."
}

Error	Cause
`invalid_request`	Missing `token` parameter

Security best practices

Always use PKCE — it is mandatory for all clients (S256 only)
Store access tokens securely (e.g. Keychain on iOS, EncryptedStorage on Android)
Access tokens expire after 15 minutes — use refresh tokens for long-lived sessions
Refresh tokens are rotated on every use — always store the new refresh token
On 401 invalid_grant, the session is over — prompt the user to re-authenticate
On 401 invalid_token, try refreshing first before prompting re-authentication

Session management

Each application installation on each device holds its own refresh token. One user can have multiple active sessions across devices and apps.

Revoke sessions via the account settings page (account.enbox.me) or programmatically via the /revoke endpoint.

Need help? Contact support at welcome@enbox.me.