Revoking Tokens?

Paul Hermans

I have successfully gotten my access token and refresh token. I know the access token will expire quickly but the refresh token about a year later. What I am wondering is if I want to disconnect the app from BB how do I revoke the refresh token so it can't be used anymore? I am assuming it is not a major issue, but thought that if I was clearing them I should also revoke them. Thanks for any help you can provide.

Alex Wong

@Paul Hermans
good question, never really thought about it.

thinking through, in order to use refresh token to get new access token, you need to use client_id and client_secret. The developer application client_id doesn't change, but the client_secret can be “regenerated”. So I imagine that when the client_secret is regenerated, the refresh token is revoked.

You can try it and report back =D

David Zeidman

@Paul Hermans It depends on the reason you want cancel your refresh token.

You can disconnect your instance of RE from the app (in the marketplace) that will expire any access tokens as well as refresh tokens so that they can no longer be used.

Alternatively if you plan on using your app but you just want to cancel the current refresh token, you can also generate a new access token without the preserve refresh token flag set. That will create a new refresh token and disable your previous refresh token (but then you have a new one)

Chris Rodgers

@David Zeidman is right here. Disconnecting the application from a Blackbaud environment (either from My Apps--as the developer--or Marketplace--as the customer) will revoke any refresh tokens associated with that Connection.

I just wanted to point out that regenerating your Client Secret (primary or secondary) does not invalidate refresh tokens. In fact, we encourage you to occasionally regenerate your client secrets as part of regular credential rotations (docs). (Still appreciate you, @Alex Wong!)

Alex Wong

@Chris Rodgers
Thanks for the info

I never tried it, but only making guessimate. Since generating a new access token from refresh token requires the use of client_id and client_secret, if the client_secret is no longer valid, then whoever is trying to use the refresh token to get a new acess token would not be able to. I'm assuming the reason the original post want to “revoke” the refresh token is so that someone having that can be “blocked” out of accessing RE NXT via SKY API. So when client_secret is invalid, then it doesn't matter if the refresh token is still valid or not.