Skip to main content

Revoke OIDC and OAuth tokens

You can revoke tokens. For example, you may want to revoke tokens if a user is an unauthorized user of the resource or a user has left your organization.

note

IDaaS automatically revokes all of a user's tokens if the user is disabled, changes their user ID, or changes their password.

When tokens are revoked, you will no longer be able to obtain the following:

  • Userinfo data when presenting an OIDC access token for it.
  • A new OAuth access token when presenting a refresh token for it.
note

After token revocation, the client application must reauthenticate the user to obtain a new access token.

Use the following procedures, as required:

Revoke an individual token​

  1. Click > Members > Users. The Users List page appears.
  2. Click the name of the user. The User Details page appears.
  3. Click the OIDC and OAuth Tokens tab. The OIDC and OAuth Tokens list appears.
  4. Click next to the token you want to revoke. The Revoke Tokens dialog box appears.
  5. Click Revoke.

The selected token is revoked.

Revoke all tokens for a user​

  1. Click > Members > Users. The Users List page appears.
  2. Click the name of the user. The User Details page appears.
  3. Under Actions, click next to the user whose tokens you want to revoke. The Revoke Tokens dialog box appears.
  4. Click Revoke.

All tokens for that user are revoked.

Revoke all tokens issued to an application​

  1. Click > Security > Applications. The Applications List page appears.
  2. Under OpenID Connect and OAuth Cloud Integrations, do one of the following:
    • Under Actions, click . The Revoke Tokens dialog box appears.
    • Under Actions, click and select Revoke All Tokens. The Revoke Tokens dialog box appears.
  3. Click Revoke.

All tokens issued to that application are revoked.

Revoke all tokens issued to an OAuth resource server​

  1. Click > Security > Authorization > APIs/URLs. The APIs/URLs List page appears.
  2. Under Actions, click next to the resource server. The Revoke Tokens dialog box appears.
  3. Click Revoke.

All tokens issued to that OAuth resource server are revoked.

warning

Revoking all tokens for an application or resource server can interrupt active sessions and API calls until tokens are reissued.