You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
Next: Root
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
The Atlassian Community can help you and your team get more value out of Atlassian products and practices.
Hello guys.
I have created forge app (macro) which calls my external api protected by oauth2.
My macro is based on this tutorial: https://developer.atlassian.com/platform/forge/use-an-external-oauth-2.0-api-with-fetch/
I have modified the provider settings to use my identity provider.
Macro seems to work and I am able to authenticate against my IDM and call protected endpoint.
Problem is that token revocation doesn't work.
When I go to "Settings" -> "Atlassian account" -> "Connected apps" -> {MY_APP} and click on revoke button next to {My IDM provider name}.
I see that revoke token endpoint was called with correct values for token (refreshToken value) and token_type_hint (refresh_token) but authorization server responds with 401 HTTP code.
It is because request to revoke token doesn't contains oauth2 client credentials neither in Authorization header nor in request body.
Can anyone explain why this credentials are not part of the request? Is there a way to achieve that client credentials will be send as part of the revoke request?
Thank you and sorry for my english