Revoking OAuth Apps access not working [404] /applications/{client_id}/grant

[oscyp]

Select Topic Area

Bug

Body

Hello all 👋

Use case: user wants to revoke his acces to the OAuth App.

I'm trying to revoke user's access on his behalf to my OAuth App (from the server side). Firebase auth is used as an identity provider.

I was following this doc - delete autohrization - but it seems not working.

It says that I have to run DELETE operation on the /applications/{client_id}/grant endpoint - what I'm doing.

I've also tried to use different client than octokit but Postman is not helping at all. Moreover, documentation redirects to the basic authentication page but the content says that this method of authentication is not supported. So, even that approach fails.

Any ideas? Maybe I'm doing sth wrong?

Code:

await octokitClient.request('DELETE /applications/{client_id}/grant', {
        client_id: 'XXXXXXXXXXXXXX',
        access_token: res[1] as string,
      });

Error:

{
   "status":404,
   "response":{
      "url":"https://api.github.com/applications/XXXXXXXXXXXXXXXXXXX/grant",
      "status":404,
      "headers":{
         "access-control-allow-origin":"*",
         "access-control-expose-headers":"ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset",
         "connection":"close",
         "content-encoding":"gzip",
         "content-security-policy":"default-src 'none'",
         "content-type":"application/json; charset=utf-8",
         "date":"Fri, 13 Jan 2023 19:55:59 GMT",
         "referrer-policy":"origin-when-cross-origin, strict-origin-when-cross-origin",
         "server":"GitHub.com",
         "strict-transport-security":"max-age=31536000; includeSubdomains; preload",
         "transfer-encoding":"chunked",
         "vary":"Accept-Encoding, Accept, X-Requested-With",
         "x-content-type-options":"nosniff",
         "x-frame-options":"deny",
         "x-github-media-type":"github.v3; format=json",
         "x-github-request-id":"FCB3:C782:CD2E145:D05C52B:63C1B74F",
         "x-ratelimit-limit":"60",
         "x-ratelimit-remaining":"59",
         "x-ratelimit-reset":"1673643359",
         "x-ratelimit-resource":"core",
         "x-ratelimit-used":"1",
         "x-xss-protection":"0"
      },
      "data":{
         "message":"Not Found",
         "documentation_url":"https://docs.github.com/rest"
      }
   },
   "request":{
      "method":"DELETE",
      "url":"https://api.github.com/applications/XXXXXXXXXXXXXXXXXXX/grant",
      "headers":{
         "accept":"application/vnd.github.v3+json",
         "user-agent":"octokit-core.js/4.1.0 Node.js/16.19.0 (win32; x64)",
         "authorization":"token [REDACTED]",
         "content-type":"application/json; charset=utf-8"
      },
      "body":"{\"access_token\":\"eyXXXXXXXXXXXXXXXXXXXX\"}",
      "request":{
         "hook":[
            "Function":"bound bound register"
         ]
      }
   }
}

[oscyp]

I was using the wrong access token. Instead of using github one, I passed firebase auth token. In addition, the github octokit client was configured incorrectly.

Proper configuration:

import { Octokit } from '@octokit/core';
import { createOAuthAppAuth } from '@octokit/auth-oauth-app';

export const baseOctokit = new Octokit({
  authStrategy: createOAuthAppAuth,
  auth: {
    clientId: config.github.client_id,
    clientSecret: config.github.client_secret,
  },
});

Documentation about this configuration is poor.

[edwardribas]

you just saved me, thanks