revoke Apple Token Api, Always Return 200

Question

caelum614 OP

Created Jun ’22

Replies 7

Boosts 4

Views 3.7k

Participants 6

I received the mail below.

Starting June 30, 2022, apps submitted to the App Store that support account creation must also include an option to initiate account deletion.

We noticed this app may support account creation. If it already offers account deletion or you’re working to implement it, we appreciate your efforts to follow the App Store Review Guidelines. Apps submitted after June 30 that do not comply with the account deletion requirements in guideline 5.1.1(v) will not pass review.

https://appleid.apple.com/auth/revoke

However, the revoke api is not working properly. Even if you throw an incorrect key value, 200 is always returned.

Is the API working properly? What should I do?

Answered by jmorley in 718226022

Also complicating things, the AuthorizationCode expires after 10 minutes. So apparently the only way to get a new code to revoke the user's token is for them to sign in again, which is a strange user experience when they are trying to delete their account and revoke authentication.

Boost

Answer 1

Minoo555 OP

Jun ’22

Not that I can offer an explanation, but I am experiencing the same, no matter what value I send to https://appleid.apple.com/auth/revoke it always returns HTTP 200 ¯_(ツ)_/¯

0

Answer 2

PotatoEater OP

Jun ’22

According doc it returns 200 also when token has been revoked already. So probably invalid token equals expired/revoked.

0

Answer 3

jmorley OP

Jun ’22

The api does nothing. We get 200 responses from all calls - new Tokens, old tokens, placeholder data - it doesn't seem to matter. We got 400 errors invalid_client for empty payload or non-encrypted form data, otherwise 200. It DOES NOT revoke authorization for any token we've posted. The only way we've successfully revoked token authentication is via ios privacy settings, or user security page. This api is not working.

0

Answer 4

jmorley OP

Jun ’22

https://stackoverflow.com/questions/72556424/how-to-validate-the-apple-revoke-token-api-appleid-apple-com-auth-revoke-succe/72656409#72656409

0

Answer 5

jmorley OP

Jun ’22

The API IS working provided the token is correct - the 200 and 400 responses are very unhelpful. The AuthorizationCode you receive with the sign-in token has to be sent to auth/token along with client id and client secret requesting a grant_type of authorization_code. The token you get back from this call is what you use in the token field of the auth/revoke form. The documentation for all of this is very confusing and the parameter names don't help.

0

Answer 6

jmorley OP

Jun ’22

Accepted Answer

Also complicating things, the AuthorizationCode expires after 10 minutes. So apparently the only way to get a new code to revoke the user's token is for them to sign in again, which is a strange user experience when they are trying to delete their account and revoke authentication.

1

Answer 7

kirill_lutarevich OP

Jul ’22

So what's actual solution? I'm having the same issue and by looking at the replies it seems like I just have to assume the revocation works if I pass valid parameters, right?

0