TRtreasure
OAuth Tokens

Revoke OAuth token

Changed on

Revokes the token named, every other live token the same user holds for the same OAuth client, and every authorization code that user was issued for the client and has not yet exchanged. Both halves of a credential live on one row, so each refresh token is closed with its access token. All of them stop working immediately, and the client must be authorized again to get a new token.

The wide reach is deliberate. An administrator revokes to contain a leaked credential, and a refresh leaves the row it replaced usable until the new token is first used -- after which the database no longer records which rows came before it. Closing the user's whole authorization is what leaves no part of it usable. Unexchanged codes go too, because whoever holds one can trade it for a new token pair without the user taking part.

One call does not settle the matter: a refresh already in flight can add a live token just after the revocation reads the rows. Re-list, and revoke again if anything remains.

If the token belongs to a sub user, revoking it deactivates that sub user too, along with its API keys. A sub user exists for one authorization, so closing the authorization ends the principal: nothing is left to run its scheduled work.

Administrators only, authenticated by an apikey or a session; an OAuth bearer token is refused. Requires the eng-lc-oauth-token-management launch control flag on the account.

Answers 404 whether the id is malformed, names no token, names a token in another account, or names one that is already revoked.

A client closing a credential it holds itself uses POST /oauth/revoke (RFC 7009), which revokes that credential and the rows a refresh still links to it, and leaves the user's other tokens for the client alone. It deactivates a sub user owner just as this does.

post/oauth_token/remove/{oauth_token_id}

Request

Path parameters

oauth_token_idId required(unresolved $ref)

Response

OK. Only the token named in the path is returned; the other tokens and the authorization codes revoked alongside it are not listed. Re-list to see what remains.

Example response

{
  "oauth_token": {
    "id": 123,
    "client": {
      "id": 456
    },
    "user": {
      "id": 123
    }
  }
}

Changes