revoke function from google-api-python-client

Question

I am creating a logout function from a django app using the built in revoke method from google-api-python-client but it doesn't seem to work. Here is my code.

def google_logout(request, user_id = None):
    storage = Storage(CredentialsModel, 'id', user_id, 'credential')
    credential = storage.get()

    if credential is not None:
        cr_json = credential.to_json()
        credential = credential.new_from_json(cr_json)

        http = httplib2.Http()
        http = credential.authorize(http)

        try:
        # Don't know yet why this is always raising an exception.
            credential.revoke(http)
            storage.delete()
        except TokenRevokeError:
            return HttpResponseBadRequest('Invalid Token.')
    else:
        return redirect('authentication:google_login')

This was working when I am using django 1.4.5 but then I needed to upgrade to 1.5.1 and now it is not working. Is this a django problem? I bet not. Please help.

P.S. I know that I can revoke the token by manually passing the access_token to this url https://accounts.google.com/o/oauth2/revoke?token={token} but I want to use the method provided in the api.

If you remove the try:except around TokenRevokeError, you should get a more detailed error message. Can you try that and see if it helps diagnose the error? — Brian Dorsey
I've tried and it seems that I don't have a refresh token saved in my credentials object. I wonder why is it like that though it is written in the client.py self.params = {'access_type': 'offline', 'response_type': 'code',} — Philamer Sune
I have the same problem, @PhilamerSune, the access_type is set to offline (via the same flow constructor in the API client, as you're using) but I apparently don't get a refresh token back in my credentials object. Not sure how to get around this.... — npdoty
Ah, resolved, using approval_prompt=force. Answer below. — npdoty

npdoty npdoty · Accepted Answer · 2014-03-26T01:43:25

Even if the access_type is set to offline, you might not get a refresh token back if you've received a refresh token in the past and didn't additionally send the query parameter approval_prompt parameter set to force.

This is particularly frustrating and likely to occur during debugging revocation. Because you're likely approving and deleting credentials frequently, sometimes Google might remember the approval and authorize without going through the forced approval process, in which case you won't get a refresh token, which the client API requires for revocation.

revoke function from google-api-python-client

1 Answers