Access and Refresh Tokens

Integrations > OAuth > Access and Refresh Tokens

When using OAuth, Clients present tokens to servers to indicate a request is authorized.

  • Access tokens grant access to resources for a short period of time. After they expire, clients can request new access tokens.

  • Refresh tokens authorize clients to request access tokens for a period of time. After they expire, clients must re-authenticate (such as sign-in again) to acquire a new refresh token.

The Access and Refresh Tokens screen reports the active OAuth access and refresh tokens for each client. Optionally an administrator may revoke a selected token. Revoking a token takes revokes access, and the application should then prompt the user to sign in again.

Note: When there are no clients with active tokens, this screen is empty.

Viewing a client's tokens

In the list of client names, click on a name to view the tokens currently assigned to the client. The lists of active Access and Refresh appears on the right. When there are no active tokens for the client, the lists are empty.

Revoking a token

  1. Click on the client name in the list of names.

  2. Locate the token to revoke.

  3. Click Select to the right of the token entry.

    The Selected token details at the top of the page updates to show the token information.

  4. Click Revoke to revoke the selected token.

The client's access will be revoked. The application should then prompt the user to sign in again.