Revoking OAuth2 Tokens

Anonymous User

As per the docs (ArcGIS REST API , Authorize—ArcGIS REST API: Users, groups, and content | ArcGIS for Developers ) there is no apparent REST Endpoint for revoking issued OAuth2 Tokens. 

In searching I stumbled across the https://www.arcgis.com/sharing/rest/oauth2/signout endpoint which can be used to sign-out of AGOL and other platforms which make use of the esri_auth cookie, however it only ever provides HTML responses, suggesting its strictly a browser flow endpoint and not for use with server side calls. 

Is there a means of revoking OAuth tokens with a purpose built REST Endpoint? Ideally, with functionality to provide either the access token directly, or the refresh token, which would invalid all associated tokens, and a response that isn't HTML.

Nicholas-Furness

Hi Paul.

I stumbled upon your question while trying to figure this out myself, so figured I'd share what I learnt.

You can use the revokeToken endpoint (https POST only) to revoke OAuth access tokens or refresh tokens. Pass in auth_token and client_id. Optionally also pass in token_type_hint as "access_token" or "refresh_token" (otherwise we'll first check if it's an access token and if it's not, check if it's a refresh token). Note that:

• Only one-step OAuth tokens generated with user logins (i.e. not clientid/secret) can be revoked.
• Revoking a refresh token revokes all access tokens generated from it.
• Revoking a token that's invalid/revoked/expired/isn't the right type will return "success".

This was introduced with the latest release of ArcGIS Online (so after your most recent comment, I believe) and documentation should be coming with the next release.

Hope this helps.

Nick.