webapi with oauth, revoke token? [closed]

Question

Hello all im following this article here to implement a webapi with individual accounts using the owin oauth.

Link

My question is there any way to revoke a tokens access to the webapi the "sign out" method really does nothing from me since ill be accessing this webapi through a phone app. Thanks for any info !

Answer 1

Revoking tokens is hard - but you can limit their lifetime and refresh them periodically. see here: http://leastprivilege.com/2013/11/15/adding-refresh-tokens-to-a-web-api-v2-authorization-server/