How to revoke an access token generated for my application?

Question

I generated an access token for my application and shared it with some people. Now, I wish to revoke the access token and generate a new one. I don't find any way to revoke that token.

Answer 1

Access tokens should never be shared.

Access tokens should never be shared with other people. Access tokens represent your account paired with the application. The access token should be protected equivalently to a password to your account. If it's a write access token, then anyone with the access token can make any and all changes to your account which the SE API permits. The SE API doesn't include the ability to change your account's login and password or other access credentials, so, fortunately, sharing a write access token doesn't give full control of your account to someone else. I should probably note that sharing your account with other people is, at lest the last time I checked, not permitted under the Stack Exchange Terms of Service, so sharing an access token may also be a violation of the Terms of Service.

Revoking access tokens for your own account through the site user interface

As Glorfindel explained, if you are wanting to cancel an access token which you have authorized for your own account, then you can do that manually through the user interface on any Stack Exchange site where you have an account. Removing one of your access tokens can be done from your profile -> "Settings" -> "API: Authorized applications" tab. A link to that page here on Stack Apps is https://stackapps.com/users/apps/104822, and on Stack Overflow: https://stackoverflow.com/users/apps/21670823. Unfortunately, it doesn't look like there's a generic link which will be translated to the current user for that settings page, but the following will get to the preferences page for any user reading this from which the "API: Authorized applications" tab will need to be selected: here on Stack Apps, on Meta Stack Exchange, and on Stack Overflow.

The "API: Authorized applications" tab and "Remove" buttons for access tokens which you've authorized looks like:

(image by rene in this question, which is about a bug that's been fixed)

Your application invalidating access tokens it holds

Your application can revoke up to 20 access tokens it holds at a time by sending a list of access tokens in a GET to /access-tokens/{accessTokens}/invalidate. The vast majority of applications will be individually run by a user, so should only have access to the access token(s) associated with that user and application. It should be very rare that an application will have access to more than one user's access token.

Answer 2

I assume you generated it with your own Stack Exchange credentials; in that case, you can find it in your Stack Overflow profile: https://stackoverflow.com/users/apps/21670823 There should be an entry for the application you registered with an a red Remove button to revoke the access token.