Guides

Revocation and deletion

Athletes can take access back at any time, from CorrConnect or from inside your app. Plan for it on day one; it is the part of an integration people notice when it goes wrong.

When the athlete disconnects inside your app

Call POST /oauth/revoke with their current access token, then delete the tokens you stored. It ends the whole grant, works even if the access token has expired, and always answers {"status": "revoked"}.

curl -X POST "$CORRCONNECT_BASE/oauth/revoke" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

const response = await fetch(`${process.env.CORRCONNECT_BASE}/oauth/revoke`, {
  method: "POST",
  headers: { Authorization: `Bearer ${process.env.ACCESS_TOKEN}` },
});
console.log(response.status, await response.json()); // 200 { status: "revoked" }

import os

import requests

response = requests.post(
    os.environ["CORRCONNECT_BASE"] + "/oauth/revoke",
    headers={"Authorization": f"Bearer {os.environ['ACCESS_TOKEN']}"},
    timeout=10,
)
print(response.status_code, response.json())  # 200 {'status': 'revoked'}

import Foundation

let env = ProcessInfo.processInfo.environment
var request = URLRequest(url: URL(string: env["CORRCONNECT_BASE"]! + "/oauth/revoke")!)
request.httpMethod = "POST"
request.setValue("Bearer \(env["ACCESS_TOKEN"]!)", forHTTPHeaderField: "Authorization")

let (data, response) = try await URLSession.shared.data(for: request)
print((response as! HTTPURLResponse).statusCode, String(decoding: data, as: UTF8.self))

Your own webhook endpoint will also get grant.revoked for it. Handle that idempotently: by then you may already have deleted the tokens.

If you only want to retire one token pair, for example when a user signs out of one device, use POST /oauth/revoke-token instead. The grant stays.

When access ends from CorrConnect's side

You learn about it in one of two ways:

• a grant.revoked webhook with the athlete's subject, or
• 401 invalid_access_token on a call, or invalid_grant on a refresh.

Treat both the same: delete the stored tokens for that sub, stop scheduled syncs, and show the athlete a Reconnect option next time they visit.

The causes are listed in scopes and grants. grant.revoked looks the same for all of them; CorrConnect doesn't tell you which one happened.

Account deletion

When an athlete deletes their CorrConnect account, CorrConnect deletes their activities, grants, tokens and device connections at once, and your app gets grant.revoked. After that:

• Their activity IDs return 404 activity_not_found.
• Their sub will never come back. A new account with the same email gets a different sub.

CorrConnect does not reach into your systems. What you keep after access ends is between you and the athlete: your own privacy policy, and the law where you and they are. Deleting what you copied when you get grant.revoked is the simplest promise to keep, and the one athletes expect.

What athletes see

In their CorrConnect account, athletes see every app they've approved, with the scopes and the date it last changed, and can revoke each one. They can also export everything CorrConnect holds about them as JSON, and delete the account. Your app's name is what they see in that list, so make it recognizable.