API usage

Revocation

Bhauu-side token/session revocation is distinct from app-owned logout.

Endpoint

HTTP form fields

POST https://auth.bhauu.online/oauth/revoke
Content-Type: application/x-www-form-urlencoded

client_id=YOUR_CLIENT_ID&token=TOKEN_TO_REVOKE

Send the token through a protected application backend when possible. A registered client secret, if used, belongs only on that backend. The endpoint revokes matching refresh capability and returns a success message even when the token was not active.

Application responsibility

Revocation does not automatically erase a previously issued access JWT, delete a user's Bhauu Identity, end every app-local session, or delete application-owned data. An app should clear its own session, stop renewal, and revalidate status on sensitive actions. Already issued access tokens are time-limited; confidential backends can use introspection to check current status.