10

I am a fair way through implementing an actionscript OAuth library which I am initially testing with Google's Drive Api.

I know how you are supposed to refresh an access token using your refresh token but my question is how do I test it?

How do I make my access_token expire so that I test my code that catches the error, attempts a refresh and then re-loads the initial request? If I can only do this once a week (or however often they expire) it's going to take a while to get it right!

Thanks

6 Answers 6

7

If you're looking to test your code, you don't actually need to invalidate or expire the access token. Simply make a (say) Drive call with a null access token and you will receive the same 401 response that you would have got with an expired access token.

2
  • Ok, thanks. That is worth knowing as it makes it easier and less time consuming to test. I wanted to see for myself that I got a 401 though. It would actually be nicer if there was some way of knowing if the token had expired or if access had been removed to prevent trying to refresh a token when it's not going to work.
    – Roaders
    Commented Jan 2, 2014 at 9:59
  • 1
    Whenever you get an access token, you are also provided with the expiration time. So your app can make a pretty good guess if the token has expired.
    – pinoyyid
    Commented Jan 3, 2014 at 3:00
3

I handle this testing by simply making note of an expired access_token. Then when I need to test how my app deals with an expired token I simply give the app that expired token to work with. This way, for example, I can test that requests with an expired token will fail as expected.

2

Well, judging by the lack of responses to this question I am assuming that there is no way to do this.

This page: https://developers.google.com/youtube/v3/guides/authentication#installed-apps

describes how to revoke an access or refresh token by using this url:

https://accounts.google.com/o/oauth2/revoke?token={token}

but then says:

The specified token can be an access token or a refresh token. If the token is an access token and it has a corresponding refresh token, the refresh token is also revoked.

So if you just want to revoke an access token you aren't able to.

I think the only solution is to wait for the access token to expire (seems to take an hour) then go about testing your app.

I'll be very happy if anyone tells me a faster way to make the token expire.

1
2

The easiest way of doing it is using the OAuth Playground 2.0

https://developers.google.com/oauthplayground/

In step 2 especially, you can try refreshing your access token with a refresh token.

Additionally, in the setting (the gear icon), you can set up your own OAuth Credentials to test it out for your own API project.

1
  • I'm, not sure that does what I am looking for. It did enable me to test out the flows but it didn't let me revoke an access_token.
    – Roaders
    Commented Jan 1, 2014 at 21:52
1

Im using nodemailer. When setting the options for the transporter object, you can specify an 'expires' time. There isn't any documentation I found on that option but I'm sure you can figure it out. :)

0

I haven't found a way to shorten the expiration time on an access token either.

In fact you can't even generate another refresh_token unless you revoke access. I don't think you can generate another refresh_token even if you let the access token expire, although I have to wait an hour to test this.

I did find out that if you send the refresh_token and the authorization token is still active, you just get the same live token back although the expiration time is reset.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.