Skip to content

Support refresh token revocation#1387

Closed
luckpoint wants to merge 1 commit intoauth0:mainfrom
luckpoint:feature/add-revoke-method
Closed

Support refresh token revocation#1387
luckpoint wants to merge 1 commit intoauth0:mainfrom
luckpoint:feature/add-revoke-method

Conversation

@luckpoint
Copy link

Changes

This PR adds a new revoke() method to the Auth0Client class that allows applications to revoke refresh tokens using the OAuth 2.0 revocation endpoint.

Classes and methods added:

  • Added revoke() method to Auth0Client class
  • Added revokeToken() function to api.ts module

Key features:

  • Revokes refresh tokens via the /oauth/revoke endpoint
  • Updates cache to remove the revoked refresh token after successful revocation
  • Does nothing if useRefreshTokens is disabled or no refresh token is found

Usage example:

// Revoke the refresh token for default audience/scope
await auth0.revoke();

// Revoke refresh token for specific audience/scope
await auth0.revoke({
  authorizationParams: {
    audience: 'https://api.example.com',
    scope: 'read:users'
  }
});

### Testing

I've updated the Quickstart to enable testing of the revoke() function.
https://github.com/luckpoint/auth0-javascript-samples/tree/feature/add-revoke-method

- [x] This change adds unit test coverage
- [x] This change adds integration test coverage
- [x] This change has been tested on the latest version of the platform/language

### Checklist

- [x] I have read the [Auth0 general contribution guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [x ] I have read the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [x] All code quality tools/guidelines have been run/followed

@luckpoint luckpoint requested a review from a team as a code owner July 30, 2025 09:13
Adds a `revokeToken` to api.ts and `revoke` to Auth0Client.ts for the revocation of refresh tokens.
This change includes unit tests
@luckpoint luckpoint force-pushed the feature/add-revoke-method branch from f9dd04e to 46162ad Compare July 31, 2025 04:15
@yogeshchoudhary147
Copy link
Contributor

Thanks for putting this together and flagging the need for this feature, really appreciate it!

We've gone ahead and implemented this natively in #1541. Same core idea but we took a slightly different approach around cache behaviour on revocation and how the worker path is handled.

Closing this in favour of #1541, thanks again!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants