Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Revocation and issued tokens

What ends a frontend user's sessions, and what a token already issued still does.

These stop refreshes at once, because they end the OAuth sessions behind your refresh tokens:

EventWhoEnds
Disconnecting the frontendThe organisation, in the Studio ("Disconnect frontend")Every OAuth session of that frontend; new sign-ins end on an error page
Blocking a frontend userThe organisation, in the StudioEvery session of that user, on every frontend of the organisation
"Sign out of all websites and apps"The user, on the sign-out pageEvery session of that user at the organisation
Password resetThe userEvery session of that user at the organisation

The next refresh then fails with a 400 (see Token endpoint errors): treat it as signed out and send the user through sign-in again.

Tokens already issued

An access token already issued stays valid until it expires, at most 1 hour. Revocation stops new tokens and refreshes, not the tokens your backend already holds. If you need to know sooner, refresh more often: a refresh is refused as soon as the session has ended.

GET /api/v1/members/me checks the token itself, not its session: after a user signs out, is blocked or resets their password, an access token already issued keeps working there until it expires too.

Disconnect and reconnect

A disconnected frontend signs no one in, and its frontend keys are refused. Reconnecting it ("Reconnect") makes sign-in and its keys work again at once, but restores no session: its users sign in again.