Granted Tokens Views

A set of views is provided to let users handle tokens that have been granted to them, without needing to accessing Django Admin Site. Every view provides access only to the tokens that have been granted to the user performing the request.

Granted Token views are listed at the url authorized_tokens/.

For each granted token there is a delete view that allows you to delete such token. You can override default templates authorized-tokens.html for the list view and authorized-token-delete.html for the delete view; they are located inside templates/oauth2_provider folder.

class oauth2_provider.views.token.AuthorizedTokenDeleteView(**kwargs)

View for revoking a specific token

form_valid(form)

Revoke the access token and its associated refresh token.

Deleting the access token on its own leaves the refresh token usable (the RefreshToken.access_token FK is SET_NULL), so it can still be exchanged for a fresh access token, defeating the revocation. Per RFC6749 Section 7009#section-2.1 revoking an access token may also revoke the respective refresh token; for a user-initiated “revoke access” action that is the only unsurprising behavior. revoke_access_token is the shared revoke path used here, by the /revoke/ endpoint, and by the admin.

get_queryset()

Return the QuerySet that will be used to look up the object.

This method is called by the default implementation of get_object() and may not be called if get_object() is overridden.

model

alias of AccessToken

class oauth2_provider.views.token.AuthorizedTokensListView(**kwargs)

Show a page where the current logged-in user can see his tokens so they can revoke them

get_queryset()

Show only user’s tokens

model

alias of AccessToken