Forge app for confluence - oauth2 provider revoke problem

[Jakub Adam]

Hello guys.

I have created forge app (macro) which calls my external api protected by oauth2.

My macro is based on this tutorial: https://developer.atlassian.com/platform/forge/use-an-external-oauth-2.0-api-with-fetch/

I have modified the provider settings to use my identity provider.

Macro seems to work and I am able to authenticate against my IDM and call protected endpoint.

Problem is that token revocation doesn't work.

When I go to "Settings" -> "Atlassian account" -> "Connected apps" -> {MY_APP}  and click on revoke button next to {My IDM provider name}.

I see that revoke token endpoint was called with correct values for token (refreshToken value) and token_type_hint (refresh_token) but authorization server responds with 401 HTTP code.

It is because request to revoke token doesn't contains oauth2 client credentials neither in Authorization header nor in request body.

Can anyone explain why this credentials are not part of the request? Is there a way to achieve that client credentials will be send as part of the revoke request?

Thank you and sorry for my english