{"action":"created","issue":{"url":"https://api.github.com/repos/googlesamples/apps-script-oauth2/issues/26","labels_url":"https://api.github.com/repos/googlesamples/apps-script-oauth2/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/googlesamples/apps-script-oauth2/issues/26/comments","events_url":"https://api.github.com/repos/googlesamples/apps-script-oauth2/issues/26/events","html_url":"https://github.com/googlesamples/apps-script-oauth2/issues/26","id":105579555,"number":26,"title":"Service_.prototype.reset doesn't revoke the token","user":{"login":"mihaiaperghis","id":8843352,"avatar_url":"https://avatars.githubusercontent.com/u/8843352?v=3","gravatar_id":"","url":"https://api.github.com/users/mihaiaperghis","html_url":"https://github.com/mihaiaperghis","followers_url":"https://api.github.com/users/mihaiaperghis/followers","following_url":"https://api.github.com/users/mihaiaperghis/following{/other_user}","gists_url":"https://api.github.com/users/mihaiaperghis/gists{/gist_id}","starred_url":"https://api.github.com/users/mihaiaperghis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mihaiaperghis/subscriptions","organizations_url":"https://api.github.com/users/mihaiaperghis/orgs","repos_url":"https://api.github.com/users/mihaiaperghis/repos","events_url":"https://api.github.com/users/mihaiaperghis/events{/privacy}","received_events_url":"https://api.github.com/users/mihaiaperghis/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-09T11:39:18Z","updated_at":"2015-09-17T19:33:58Z","closed_at":"2015-09-17T19:33:58Z","body":"Hi!\r\n\r\nI noticed that Service_.prototype.reset only deletes the access token and all other details from the user properties, but doesn't actually revoke the token.\r\n\r\nThis means that if I have access_type as 'offline' and I use Service_.prototype.reset, I won't receive a new refresh token upon re-authorization. The only way to generate a refresh token is to go in the Google account and manually revoke the app access.\r\n\r\nI saw that the [developer docs](https://developers.google.com/youtube/v3/guides/auth/installed-apps#OAuth2_Revoking_a_Token) mention a way to programmatically revoke the token using https://accounts.google.com/o/oauth2/revoke?token={token}\r\n\r\nIt would be useful to have that included in the reset() function, so that the user can completely remove access and properly re-authorize (and receive a new refresh_token if they need to).\r\n\r\nCheers!"},"comment":{"url":"https://api.github.com/repos/googlesamples/apps-script-oauth2/issues/comments/141201925","html_url":"https://github.com/googlesamples/apps-script-oauth2/issues/26#issuecomment-141201925","issue_url":"https://api.github.com/repos/googlesamples/apps-script-oauth2/issues/26","id":141201925,"user":{"login":"erickoledadevrel","id":991384,"avatar_url":"https://avatars.githubusercontent.com/u/991384?v=3","gravatar_id":"","url":"https://api.github.com/users/erickoledadevrel","html_url":"https://github.com/erickoledadevrel","followers_url":"https://api.github.com/users/erickoledadevrel/followers","following_url":"https://api.github.com/users/erickoledadevrel/following{/other_user}","gists_url":"https://api.github.com/users/erickoledadevrel/gists{/gist_id}","starred_url":"https://api.github.com/users/erickoledadevrel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erickoledadevrel/subscriptions","organizations_url":"https://api.github.com/users/erickoledadevrel/orgs","repos_url":"https://api.github.com/users/erickoledadevrel/repos","events_url":"https://api.github.com/users/erickoledadevrel/events{/privacy}","received_events_url":"https://api.github.com/users/erickoledadevrel/received_events","type":"User","site_admin":false},"created_at":"2015-09-17T19:33:58Z","updated_at":"2015-09-17T19:33:58Z","body":"Unfortunately revoking tokens is not part of the OAuth2 specification, so there is no standard way to do it. Given that this library is a general purpose one, I wouldn't want to hard-code some Google-specific behavior. Given how easy it is to make this request yourself using `UrlFetchApp`, I don't think there is much benefit either."}}