Revoke access token for Twitter api

0
votes

I'm trying to figure out if I'm using the correct API calls to revoke my apps access to a users Twitter account (so when a user attempts to log in with Twitter again they have to grant my app access instead of not asking to log in)

On my app locally I have a server running where a user has the capability to grant my app access to their Twitter. I am successful at obtaining an access token using 

https://api.twitter.com/oauth/request_token

but when it comes to revoking that same access token I've attempted to use

https://api.twitter.com/oauth2/invalidate_token

described here: https://developer.twitter.com/en/docs/basics/authentication/api-reference/invalidate_token

but it seems to use oauth1 to obtain the access_token and oauth2 to invalidate it which seems odd. I'm able to POST but the error I receive is 403 "Unable to verify your credentials"

In the description of invalidate_token call, it mentions invalidating an "OAuth 2 Bearer Token" but obtaining the token I obtained an "OAuth Request Token".

Can one authenticate with OAuth2 to invalidate a token obtained with OAuth1? Or am I missing something?

The server is running PHP and calls are with curl.

1
apitwitteroauthoauth-2.0twitter-oauth

1 Answers

0
votes

You cannot programmatically revoke OAuth1 tokens using the Twitter API, unless you are using Bearer Tokens. In your case, you are not using Bearer tokens, but standard OAuth1 request and access tokens.

Rather than revoking access, you can direct users to the GET oauth/authorize endpoint which requires the user to re-approve the application:

https://developer.twitter.com/en/docs/basics/authentication/api-reference/authorize

However, please think carefully about why you are doing this -- typically, a user grants your application permissions once and then revokes it themselves through their Twitter settings, as described here:

https://help.twitter.com/en/managing-your-account/connect-or-revoke-access-to-third-party-apps