TypeScript SDK — Account Services: OAuth Token Revocation

Low-level OAuth token revocation endpoint. This method is on client.accountServices.

See the API specifications for the full request/response schema and the authentication guide for OAuth setup.

Methods

revokeOAuthToken

POST /v1/oauth/revokeByToken · Authenticated

Revokes the current OAuth access and refresh tokens. This is the low-level REST endpoint — most users should use OAuthAuth.revoke(transport) instead, which handles token lifecycle, store cleanup, and calls this endpoint under the hood.

Code
// Low-level: direct REST call
const result = await client.accountServices.revokeOAuthToken({});
console.log(result.message); // confirmation message

This is a POST mutation — never automatically retried.

The preferred approach uses the OAuthAuth class directly. Since the GeminiMarkets client does not expose its internal transport, construct an HttpTransport separately:

Code
import { HttpTransport, OAuthAuth } from "gemini-markets/server";

const auth = new OAuthAuth({
  client: { type: "public", clientId: "your-client-id", redirectUri: "http://localhost:3000/callback" },
  tokenStore: yourTokenStore,
});

// Construct a transport using the same auth instance
const transport = new HttpTransport({ env: "production", auth });

await auth.revoke(transport);
// Tokens are revoked server-side and cleared from your token store

When to use each:

• OAuthAuth.revoke(transport) — the recommended path. It validates that the transport uses the same OAuthAuth instance, ensures tokens are loaded and valid, calls the revocation endpoint, and then clears the token store. Note that these are two separate operations — the server-side revocation happens first, then the local store is cleared. If revocation succeeds but the store clear fails (e.g. a storage I/O error), your local store may still hold invalidated tokens. Handle this by catching errors and clearing the store manually if needed. Use this for logout flows, token rotation, and session cleanup.
• client.accountServices.revokeOAuthToken({}) — the raw REST call. Use only if you need direct control over the HTTP request (e.g. custom error handling, auditing) and are managing token store cleanup yourself.

Caveat: After revocation, the access token and refresh token are both invalidated. You'll need to complete a new authorization flow to obtain fresh tokens.

What's next

• Authentication — OAuth setup, HMAC auth, and the OAuthAuth class
• Error Handling — OAuthTokenError and OAuthAuthorizationError