How to revoke user access token granted by Twitter to an app via Twitter REST API

Question

I have a Node JS app that uses Twitter API (using OAuth 1.0a) to authenticate users and posts tweets on behalf of the users using the provided user access token.

I also want to provide a way for a user of my app to "disconnect" from Twitter by revoking the access token provided earlier, such that the user must log into Twitter the next time he wants to access it via my app.

I also have a similar integration with Facebook (via OAuth 2), and the legal way to do that with Facebook is via the DELETE request to the /me/permissions route. For Twitter, I found a way (mentioned on this page: https://dev.twitter.com/oauth/reference/post/oauth2/invalidate/token) to invalidate the access token, but it seems to fail with "Unable to verify your credentials" error. I know I'm providing the right credentials, because instead of posting to that endpoint if I just post a tweet with the same credentials, I'm able to do that successfully.

One thing to note: I found that Twitter does not support OAuth2 for user authentication, which is why I used OAuth 1 for Twitter. Not sure if it's got something to do with this.

Sample code from my app that is trying to revoke the token:

var logout = function(userAccessToken, userAccessTokenSecret, done) {
    oauth.post(
      "https://api.twitter.com/oauth2/invalidate_token",
      userAccessToken, userAccessTokenSecret,
      {"access_token": userAccessToken},
      "application/json",
      function(error, data) {
        console.log("response from Twitter: error = " + JSON.stringify(error) + ", data = " + JSON.stringify(data));
        done(error, data);
      }
    );
}

i'm pretty sure that this only works with Bearer token you get through dev.twitter.com/oauth/reference/post/oauth2/token — Johannes Merz
Why not just use the OAuth 1.0a invalidation API: developer.twitter.com/en/docs/basics/authentication/… — Gargi Gupta

Johannes Merz Johannes Merz · Accepted Answer · 2017-08-12T09:58:38

It seems as this is not possible right now. The route you provided only works with application only tokens you can get through

https://dev.twitter.com/oauth/reference/post/oauth2/token

According to the faq section tokens can be revoked by the user themself in their settings.

Further i found this post in the twitter community that asks basically the same question as you do:

https://twittercommunity.com/t/actively-revoking-oauth-access-tokens/1505

There's currently no way for an application to voluntarily revoke the access tokens for a user who has granted an application access. If you determine a certain period of inactivity on your service as implying the user is no longer using your application, your best avenue is to remove the access token from your records. If the user ever comes back, you can re-negotiate it for them.

So it seems to me that its easiest to just delete the token on your Side.

How to revoke user access token granted by Twitter to an app via Twitter REST API

1 Answers