Forge app for confluence - oauth2 provider revoke problem

[Jakub Adam]

Hello guys.

I have created forge app (macro) which calls my external api protected by oauth2.

My macro is based on this tutorial: https://developer.atlassian.com/platform/forge/use-an-external-oauth-2.0-api-with-fetch/

I have modified the provider settings to use my identity provider.

Macro seems to work and I am able to authenticate against my IDM and call protected endpoint.

Problem is that token revocation doesn't work.

When I go to "Settings" -> "Atlassian account" -> "Connected apps" -> {MY_APP}  and click on revoke button next to {My IDM provider name}.

I see that revoke token endpoint was called with correct values for token (refreshToken value) and token_type_hint (refresh_token) but authorization server responds with 401 HTTP code.

It is because request to revoke token doesn't contains oauth2 client credentials neither in Authorization header nor in request body.

Can anyone explain why this credentials are not part of the request? Is there a way to achieve that client credentials will be send as part of the revoke request?

Thank you and sorry for my english

[Mazen Chmait_FusionTech Innovations_Marketplace Partner]

Hello @Jakub Adam

I'm facing the same issue, and can't call the revoke programmatically. and to add to that only authorization-header bearer type is now allowed. this is a big setback since it does not make sense to oauth2 providers.
I'm wondering if you managed to solve this issue.
Thanks,