You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Access tokens for a client can be revoked when needed. As this removes the client's way of authenticating this client can no
301
+
longer be used after this call. This method is only available for OAuth2 clients.
302
+
303
+
To revoke current client's tokens in the storage use the following code:
304
+
305
+
<!-- sample post_oauth2_revoke -->
306
+
307
+
```js
308
+
awaitoauth.revokeTokens();
309
+
// client's tokens have been revoked
310
+
```
311
+
312
+
### Downscoping tokens
313
+
314
+
You can exchange a client's access token for one with a lower scope, in order
315
+
to restrict the permissions for a child client or to pass to a less secure
316
+
location (e.g. a browser-based app). This method is only available for OAuth2 clients.
317
+
318
+
For example to exchange the client's token for one with scopes to upload and delete items, but not to view their contents, which would be suitable for an less-trusted server-side process; use the following code:
319
+
320
+
<!-- sample post_oauth2_token downscope_token -->
321
+
322
+
```js
323
+
let accessToken =awaitoauth.downscopeToken(['item_upload', 'item_delete']);
324
+
// accessToken contains the new downscoped access token
0 commit comments