Removing access

A third party’s access to an account lasts until its tokens are revoked.

The third party disconnects

When a merchant disconnects in the third party’s app, the third party should revoke its refresh token, which also stops it getting new access tokens:

POST https://merchant.shuttleglobal.com/revoke
Content-Type: application/x-www-form-urlencoded

token=rt_1234_8xLOxBtZp8
&token_type_hint=refresh_token
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET

Use token_type_hint=access_token to revoke an access token. See Revoke a token.

The platform removes a third party from an account

The platform that owns the account can remove a third party’s access to it with its API key. This revokes every refresh token that client holds for the account:

curl -X DELETE -u "$SHUTTLE_SECRET_KEY:" \
  https://app.shuttleglobal.com/c/api/instances/M12345/oauth/CLIENT_ID

The merchant

A merchant can’t yet see or revoke third-party access in the Merchant Portal. Disconnecting an account from the Merchant Portal (Unlink) stops it being offered to third parties in future, but doesn’t revoke access a third party already has: ask the platform, or the third party, to remove it.