This application discloses an authorization revocation method and an apparatus, and relates to the communications field. An example method includes: receiving, by a first entity, an authorization revocation request message from a second entity, wherein the authorization revocation request message carries an identifier of an application programming interface (API) invocation entity; and sending, by the first entity, an authorization revocation response message to the second entity based on the authorization revocation request message, wherein the authorization revocation response message indicates that authorization revocation succeeds or fails.