Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
feat(backend): add OAuth application token revocation by jfoshee · Pull Request #9040 · clerk/javascript · GitHub
Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' feat(backend): add OAuth application token revocation by jfoshee · Pull Request #9040 · clerk/javascript · GitHub
Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' feat(backend): add OAuth application token revocation by jfoshee · Pull Request #9040 · clerk/javascript · GitHub
Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' feat(backend): add OAuth application token revocation by jfoshee · Pull Request #9040 · clerk/javascript · GitHub
Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' feat(backend): add OAuth application token revocation by jfoshee · Pull Request #9040 · clerk/javascript · GitHub
Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' feat(backend): add OAuth application token revocation by jfoshee · Pull Request #9040 · clerk/javascript · GitHub
Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano
, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); feat(backend): add OAuth application token revocation by jfoshee · Pull Request #9040 · clerk/javascript · GitHub
Skip to content

feat(backend): add OAuth application token revocation - #9040

Merged
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens
Jun 30, 2026
Merged

feat(backend): add OAuth application token revocation#9040
wobsoriano merged 1 commit into
mainfrom
jfoshee/user-5645-sdk-revoke-oauth2-tokens

Conversation

@jfoshee

@jfosheejfoshee commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds SDK support for the new OAuth application token revocation endpoint and documents the backend SDK method.

Validation run:

  • go test ./oauthapplication
  • pnpm --filter @clerk/backend test:node src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend test:edge-runtime src/api/tests/OAuthApplicationsApi.test.ts
  • pnpm --filter @clerk/backend lint
  • pnpm run build:tsx in clerk-docs
  • pnpm run lint in clerk-docs

Changes in this repo

Adds clerkClient.oauthApplications.revokeToken(), handles 204 responses as void, includes focused node and edge-runtime tests, and adds a changeset for @clerk/backend.

Companion PRs

Summary by CodeRabbit

  • New Features

    • Added the ability to revoke OAuth application access and refresh tokens from the backend client.
  • Bug Fixes

    • Improved handling of no-content responses so successful revocation calls return cleanly without errors.
    • Added validation feedback when a required OAuth application ID is missing.
  • Documentation

    • Updated release guidance to reflect this new backend capability.

@changeset-bot

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2aff791

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
NameType
@clerk/backendMinor
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Jun 30, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentJun 30, 2026 12:25am
swingsetReadyReadyPreview, CommentJun 30, 2026 12:25am

Request Review

@coderabbitai

coderabbitaiBot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

Adds revokeToken to OAuthApplicationsApi, which POSTs to /oauth_applications/:id/revoke_token. The buildRequest function gains an early-return for HTTP 204 responses. Tests and a minor changeset entry for @clerk/backend are included.

Changes

OAuth Application revokeToken

Layer / File(s)Summary
204 response handling
packages/backend/src/api/request.ts
buildRequest returns {data: undefined, errors: null} immediately for res.status === 204 without parsing the body.
revokeToken type and method
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
Adds RevokeOAuthApplicationTokenParams type and revokeToken method that validates oauthApplicationId and POSTs to the revoke_token sub-path with token as a body param, returning void.
Tests and changeset
packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts, .changeset/oauth-application-revoke-token.md
MSW-backed tests assert 204 maps to undefined and empty oauthApplicationId rejects; changeset marks @clerk/backend as minor.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

  • wobsoriano

Poem

🐇 Hop hop, a token revoked today,
POST to the path, then 204 hooray!
No body to parse, just undefined returned,
A new little method the backend has earned.
The rabbit stamps the changeset with glee~ 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly matches the main change: adding backend support for OAuth application token revocation.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch

Comment @coderabbitai help to get the list of available commands.

@pkg-pr-new

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9040

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9040

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9040

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9040

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9040

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9040

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9040

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9040

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9040

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9040

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9040

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9040

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9040

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9040

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9040

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9040

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9040

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9040

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9040

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9040

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9040

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9040

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9040

commit: 2aff791

@github-actions

Copy link
Copy Markdown
Contributor

API Changes Report

Generated by Break Check on 2026-06-30T00:27:21.714Z

Summary

MetricCount
Packages analyzed19
Packages with changes0
🔴 Breaking changes0
🟡 Non-breaking changes0
🟢 Additions0

No API Changes Detected

All packages have stable APIs with no detected changes.


Report generated by Break Check

Last ran on 2aff791.

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
packages/backend/src/api/endpoints/OAuthApplicationsApi.ts (1)

40-49: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add JSDoc and an explicit return type to revokeToken()
clerkClient.oauthApplications.revokeToken() is public packages/** surface; add method-level JSDoc for the generated reference docs and annotate it as Promise<void>.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts` around lines 40 -
49, Add method-level JSDoc to revokeToken() so it appears correctly in the
generated reference docs, and annotate its signature with an explicit
Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

Sources: Coding guidelines, Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/backend/src/api/endpoints/OAuthApplicationsApi.ts`:
- Around line 40-49: Add method-level JSDoc to revokeToken() so it appears
correctly in the generated reference docs, and annotate its signature with an
explicit Promise<void> return type. Update the revokeToken() declaration in
OAuthApplicationsApi alongside RevokeOAuthApplicationTokenParams so the public
clerkClient.oauthApplications surface is fully typed and documented.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 151c11d6-dd13-420b-a35f-bd4ab3fa5c53

📥 Commits

Reviewing files that changed from the base of the PR and between 2914c2c and 2aff791.

📒 Files selected for processing (4)
  • .changeset/oauth-application-revoke-token.md
  • packages/backend/src/api/__tests__/OAuthApplicationsApi.test.ts
  • packages/backend/src/api/endpoints/OAuthApplicationsApi.ts
  • packages/backend/src/api/request.ts

@wobsorianowobsoriano left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good 👍🏼

@wobsoriano
wobsoriano merged commit 6a9bb60 into mainJun 30, 2026
55 checks passed
@wobsoriano
wobsoriano deleted the jfoshee/user-5645-sdk-revoke-oauth2-tokens branch June 30, 2026 02:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@jfoshee@wobsoriano