---
title: "Revoke a user's access token"
description: "DELETE /users/{external_ref}/token: Revokes a user's access token at once."
url: https://docs.tryflume.ai/api/revoke-user-token
updated: 2026-11-11
---

# Revoke a user's access token

> DELETE /users/{external_ref}/token: Revokes a user's access token at once.

Revokes a user's access token at once.

```http
DELETE https://sandbox-api.tryflume.ai/partner/v1/users/{external_ref}/token
```

- Every iframe session opened with it ends at its next call.
- Verify the user again to issue a new token.

## Request

### Headers

| Header | Required | Description |
|---|---|---|
| `X-Flume-Partner-Key` | Yes | Your partner key. |

### Path parameters

| Parameter | Type | Description |
|---|---|---|
| `external_ref` | string | Your id for the user, as you sent it when the user verified. |

### Sample

**curl**

```sh
curl -X DELETE "https://sandbox-api.tryflume.ai/partner/v1/users/u_8812/token" \
  -H "X-Flume-Partner-Key: $FLUME_PARTNER_KEY"
```

**Python**

```python
import os

import requests

headers = {
    "X-Flume-Partner-Key": os.environ["FLUME_PARTNER_KEY"],
}

response = requests.delete(
    "https://sandbox-api.tryflume.ai/partner/v1/users/u_8812/token",
    headers=headers,
    timeout=30,
)
response.raise_for_status()
print(response.status_code)
```

**Node.js**

```js
const response = await fetch("https://sandbox-api.tryflume.ai/partner/v1/users/u_8812/token", {
  method: "DELETE",
  headers: {
    "X-Flume-Partner-Key": process.env.FLUME_PARTNER_KEY,
  },
});
if (!response.ok) throw new Error(`${response.status} ${await response.text()}`);
console.log(response.status);
```

## Returns (204)

**Response (204)**: no body.

## Errors

| Status | Code | Meaning |
|---|---|---|
| 401 | `EMBED_TOKEN_INVALID` | You sent an `Authorization` header and no `X-Flume-Partner-Key`. Flume read the call as one from its own iframe. |
| 401 | `PARTNER_KEY_INVALID` | The partner key is missing, unknown, revoked, expired, or from the other environment. On live, also a platform Flume has not enabled yet. |
| 404 | `NOT_FOUND` | The thing does not exist, or is not this user's. A search id that is not a UUID also returns this code. |
| 422 | `VALIDATION_FAILED` | A field is missing, unknown or has an unusable value. `field` names it as a dotted path. Some refusals carry the detail in `details` and leave `field` empty. |
| 500 | `INTERNAL` | Something failed on Flume's side. |

Every code, with its fix: [API error codes](https://docs.tryflume.ai/api/errors.md).

Guide: [Users and verification](https://docs.tryflume.ai/concepts/users.md).