# TypeScript SDK — Account Services: OAuth Token Revocation

Low-level OAuth token revocation endpoint. This method is on `client.accountServices`.

See the [API specifications](/api-specifications) for the full request/response schema and the [authentication guide](/tools/typescript-sdk/authentication) for OAuth setup.

## Methods

### revokeOAuthToken

`POST /v1/oauth/revokeByToken` · Authenticated

Revokes the current OAuth access and refresh tokens. This is the **low-level REST endpoint** — most users should use `OAuthAuth.revoke(transport)` instead, which handles token lifecycle, store cleanup, and calls this endpoint under the hood.

```ts
// Low-level: direct REST call
const result = await client.accountServices.revokeOAuthToken({});
console.log(result.message); // confirmation message
```

This is a POST mutation — never automatically retried.

The preferred approach uses the `OAuthAuth` class directly. Since the `GeminiMarkets` client does not expose its internal transport, construct an `HttpTransport` separately:

```ts
import { HttpTransport, OAuthAuth } from "gemini-markets/server";

const auth = new OAuthAuth({
  client: { type: "public", clientId: "your-client-id", redirectUri: "http://localhost:3000/callback" },
  tokenStore: yourTokenStore,
});

// Construct a transport using the same auth instance
const transport = new HttpTransport({ env: "production", auth });

await auth.revoke(transport);
// Tokens are revoked server-side and cleared from your token store
```

> **When to use each:**
>
> - **`OAuthAuth.revoke(transport)`** — the recommended path. It validates that the transport uses the same `OAuthAuth` instance, ensures tokens are loaded and valid, calls the revocation endpoint, and then clears the token store. Note that these are **two separate operations** — the server-side revocation happens first, then the local store is cleared. If revocation succeeds but the store clear fails (e.g. a storage I/O error), your local store may still hold invalidated tokens. Handle this by catching errors and clearing the store manually if needed. Use this for logout flows, token rotation, and session cleanup.
> - **`client.accountServices.revokeOAuthToken({})`** — the raw REST call. Use only if you need direct control over the HTTP request (e.g. custom error handling, auditing) and are managing token store cleanup yourself.

> **Caveat:** After revocation, the access token and refresh token are both invalidated. You'll need to complete a new authorization flow to obtain fresh tokens.

## What's next

- [Authentication](/tools/typescript-sdk/authentication) — OAuth setup, HMAC auth, and the `OAuthAuth` class
- [Error Handling](/tools/typescript-sdk/errors) — `OAuthTokenError` and `OAuthAuthorizationError`