I received the mail below.
Starting June 30, 2022, apps submitted to the App Store that support account creation must also include an option to initiate account deletion.
We noticed this app may support account creation. If it already offers account deletion or you’re working to implement it, we appreciate your efforts to follow the App Store Review Guidelines. Apps submitted after June 30 that do not comply with the account deletion requirements in guideline 5.1.1(v) will not pass review.
However, the revoke api is not working properly. Even if you throw an incorrect key value, 200 is always returned.
Is the API working properly? What should I do?
-
—
jmorley
-
—
jmorley
Add a CommentThe api does nothing. We get 200 responses from all calls - new Tokens, old tokens, placeholder data - it doesn't seem to matter. We got 400 errors invalid_client for empty payload or non-encrypted form data, otherwise 200. It DOES NOT revoke authorization for any token we've posted. The only way we've successfully revoked token authentication is via ios privacy settings, or user security page. This api is not working.
The API IS working provided the token is correct - the 200 and 400 responses are very unhelpful. The AuthorizationCode you receive with the sign-in token has to be sent to auth/token along with client id and client secret requesting a grant_type of authorization_code. The token you get back from this call is what you use in the token field of the auth/revoke form. The documentation for all of this is very confusing and the parameter names don't help.