# Removing access

> A third party's access to an account lasts until its tokens are revoked.

A third party's access to an account lasts until its tokens are revoked.

## The third party disconnects

When a merchant disconnects in the third party's app, the third party should revoke its refresh token, which also stops it getting new access tokens:

```http
POST https://merchant.shuttleglobal.com/revoke
Content-Type: application/x-www-form-urlencoded

token=rt_1234_8xLOxBtZp8
&token_type_hint=refresh_token
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
```

Use `token_type_hint=access_token` to revoke an access token. See [Revoke a token](/platforms/reference/oauth/operations/revoketoken/).

## The platform removes a third party from an account

The platform that owns the account can remove a third party's access to it with its API key. This revokes every refresh token that client holds for the account:

```bash
curl -X DELETE -u "$SHUTTLE_SECRET_KEY:" \
  https://app.shuttleglobal.com/c/api/instances/M12345/oauth/CLIENT_ID
```

## The merchant

A merchant can't yet see or revoke third-party access in the Merchant Portal. Disconnecting an account from the Merchant Portal (**Unlink**) stops it being offered to third parties in future, but doesn't revoke access a third party already has: ask the platform, or the third party, to remove it.