In sites when user changes password, the authorized apps aren't revoked.

How does one revoke refresh tokens without actually knowing the token value?

1 Answer 1


OAuth2 is a Single Sign On mechanism. The server (e.g. salesforce) proves to the app that the user is who they say they are, since they have already proven themselves by logging into Salesforce. Resetting a user's password doesn't change their identity, only how they prove their identity to salesforce.

Administrators can visit Setup > Manage Apps > Connected Apps OAuth Usage to revoke an app for a user or for all users. An administrator or user can also visit the user detail page and revoke any app they've granted access to using the Revoke option. If the user cannot view the Setup screen, they will probably need assistance from their administrator to revoke access to the application.

  • Totally understand this. The motivation here is that if user misplaces one of the authorized devices, he (or business) might want to have an option to disable that device.
    – dzh
    Sep 10, 2015 at 1:47
  • Wait a second. Just found a OatuhToken object and DeleteToken field in it. Will try to use this token in REST revoke API. Record delete is not permitted.
    – dzh
    Sep 10, 2015 at 1:54
  • 1
    Yup, deleteToken from this field works with REST revoke API. More info at developer.salesforce.com/docs/atlas.en-us.api.meta/api/…
    – dzh
    Sep 20, 2015 at 0:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .