User authorizations show which applications each member has authorized, the scopes they granted, when the authorization was last used, and whether it is still valid.
Open Account Center, then select User Authorizations.
Before You Use The List
- A record appears after a member has authorized an application, so an empty list means no application has been authorized yet
- Authorizations belong to a client, so one application with two clients produces two records
- Revoking needs no downtime on the application side, but the member has to authorize again before the application can use the new token
Revoke An Authorization
- Find the record with the status filter set to Authorized and the search narrowed to the member, application, or client ID
- Choose Revoke on the row and confirm. The confirmation names the member and the application
- After revoking, the access token of that authorization stops working. The member has to authorize the application again at the next sign-in. The record stays in the list with the status Revoked
Verify A Revoke
- Revoke the authorization and confirm that the row now shows the status Revoked
- Ask the member to sign in from the application again; the authorization page must ask for consent again
- Refresh the list and check the status of the new record
Export An Audit Record
- Set the authorization time range, the status, or a keyword so that the list contains exactly the records you need
- Choose Export. The export contains all matching records, not only the current page
Troubleshooting
| Symptom | What to check |
|---|
| The application still works after revoking | The application may use another client of the same application; check whether a second client has an active authorization |
| The list is empty | No application has authorized yet, or the filters exclude everything. Clear the status filter and widen the time range |
| A record is missing that the application reports | The record belongs to the member and client that completed the authorization; search by the client ID |
| The export is disabled | The current filters match no records |
Filters
| Filter | Description |
|---|
| Authorization time range | Only shows authorizations created inside the selected start and end time |
| Status | All statuses, authorized, or revoked |
| Search | Searches user, email, application name, and client ID |
List Columns
| Column | Description |
|---|
| Authorized at | Time of the most recent authorization by the member |
| User | Member that granted the authorization |
| Application | Application that received the authorization |
| Last used at | Time the authorization was most recently used |
| Status | Authorized or revoked |
Granted scopes are stored with the authorization: confirm identity, basic profile, and email address.
Statuses
| Status | Meaning |
|---|
| Authorized | The access token is valid; the application can keep using it |
| Revoked | The access token no longer works; the member must authorize the application again at the next sign-in |
Actions
| Action | Description |
|---|
| Refresh | Reloads the authorization records |
| Export | Exports every record that matches the current filters to a spreadsheet named user-authorizations-<timestamp>.xlsx with an Authorizations sheet |
| Revoke | Asks for confirmation, then invalidates the access token that the member granted to the application. The confirmation names the member and the application, and the member must authorize the application again at the next sign-in |
The exported file contains the authorization time, user, email, application, client ID, granted scopes, last used time, and status, so it includes the email, client ID, and scopes that the list does not show as columns.