Revoke a token

Yandex OAuth revokes tokens in the following cases:

• The user revokes access on the Data access rights page. When the OAuth token is revoked, the corresponding refresh token is revoked automatically.

• The token expired.

• The app owner changed the requested rights or deleted the app. In this case, all tokens ever issued to this app are revoked.

• The user performed an action that revokes all OAuth tokens and refresh tokens ever issued for the account:

  • Changed password.

  • Turned two-factor authentication on or off.

  • Successfully restored access to the account.

  • Followed the link Log out on all devices in Yandex ID or another service.

Revoking tokens in the app

The app can revoke OAuth tokens issued for a specific device with a request to Yandex OAuth.

To implement logging out of an account for regular tokens, you can delete the corresponding tokens from local storage. A deleted token can't be restored via Yandex OAuth, the app will have to request access again.

In this case, nothing changes for the user on the Data access rights page. A token issued to the application is considered active until it is revoked in any of the ways listed above.

Revoking a token for a specific device

Using Yandex OAuth, you can request a token for an app on a specific device. To do this, specify the device ID and its name in the request for a token or confirmation code (the device_id and device_name parameters described in the request formats in this document). The user can see this name on the access control page in API Yandex ID. If you only specify an ID without a name, the token will be marked as issued for an unknown device.

A token issued for a specific device can be revoked with a request to Yandex OAuth, for example, to ensure that the user logs out of the account.

To revoke a token, send it to Yandex OAuth with the app ID and password.

App authentication

In requests to Yandex OAuth, specify the ID and password generated when registering the app.

You can pass them in a request in different ways:

• In the Authorization header, in the <client_id>:<client_secret> line, encoded with the base64 method. In this case, you should specify the basic authorization method (Basic).

  Header example:

  Authorization: Basic <encoded string client_id:client_secret>
  

• In the POST request body, in the client_id and client_secret parameters. These parameters must be passed all at once.

If Yandex OAuth receives the Authorization header, while the client_id and client_secret parameters in the request body are ignored.

Request format

The request should be sent over HTTPS using the POST method.

POST /revoke_token HTTP/
1.1Host: https://oauth.yandex.com/
Content-type: application/x-www-form-urlencoded
Content-Length: <request body length>
[Authorization: Basic <encoded string client_id:client_secret>]

 & access_token=<token to revoke>
[& client_id=<app ID>]
[& client_secret=<secret key>]

Response format

Yandex OAuth returns the response in a JSON document.

{
  "status": "ok"
}

{
  "error_description": "Client not found",
  "error": "invalid_client"
}