curl --request DELETE \
--url https://api.tassyir.io/developer/apps/{appId}/credentials/{credentialId} \
--header 'Authorization: Bearer <token>'const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tassyir.io/developer/apps/{appId}/credentials/{credentialId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"data": {
"id": "<string>",
"secretPrefix": "<string>",
"state": "active",
"createdAt": "2023-11-07T05:31:56Z",
"expiresAt": "2023-11-07T05:31:56Z",
"revokedAt": "2023-11-07T05:31:56Z"
}
}{
"code": "DEVELOPER_TOKEN_INVALID",
"message": "<string>",
"statusCode": 123,
"fix": "<string>",
"errors": [
{
"code": "<string>",
"path": "<string>",
"message": "<string>",
"fix": "<string>"
}
],
"path": "<string>",
"requestId": "<string>"
}{
"code": "APP_CREDENTIAL_NOT_FOUND",
"message": "<string>",
"statusCode": 123,
"fix": "<string>",
"errors": [
{
"code": "<string>",
"path": "<string>",
"message": "<string>",
"fix": "<string>"
}
],
"path": "<string>",
"requestId": "<string>"
}{
"code": "DEVELOPER_TOKEN_RATE_LIMITED",
"message": "<string>",
"statusCode": 123,
"fix": "<string>",
"errors": [
{
"code": "<string>",
"path": "<string>",
"message": "<string>",
"fix": "<string>"
}
],
"path": "<string>",
"requestId": "<string>"
}{
"statusCode": 123,
"message": "<string>",
"path": "<string>",
"requestId": "<string>"
}{
"statusCode": 123,
"message": "<string>",
"path": "<string>",
"requestId": "<string>"
}Revoke a client secret now
The token endpoint refuses it from this moment; access tokens already issued live out their hour. Idempotent. Allowed on a suspended account and a read-only app: a leaked secret must always be killable.
Takes the dashboard session or a developer token (tsy_dt_…); either way the caller is the signed-in user, and only their own account, apps and tokens are reachable.
curl --request DELETE \
--url https://api.tassyir.io/developer/apps/{appId}/credentials/{credentialId} \
--header 'Authorization: Bearer <token>'const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.tassyir.io/developer/apps/{appId}/credentials/{credentialId}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"data": {
"id": "<string>",
"secretPrefix": "<string>",
"state": "active",
"createdAt": "2023-11-07T05:31:56Z",
"expiresAt": "2023-11-07T05:31:56Z",
"revokedAt": "2023-11-07T05:31:56Z"
}
}{
"code": "DEVELOPER_TOKEN_INVALID",
"message": "<string>",
"statusCode": 123,
"fix": "<string>",
"errors": [
{
"code": "<string>",
"path": "<string>",
"message": "<string>",
"fix": "<string>"
}
],
"path": "<string>",
"requestId": "<string>"
}{
"code": "APP_CREDENTIAL_NOT_FOUND",
"message": "<string>",
"statusCode": 123,
"fix": "<string>",
"errors": [
{
"code": "<string>",
"path": "<string>",
"message": "<string>",
"fix": "<string>"
}
],
"path": "<string>",
"requestId": "<string>"
}{
"code": "DEVELOPER_TOKEN_RATE_LIMITED",
"message": "<string>",
"statusCode": 123,
"fix": "<string>",
"errors": [
{
"code": "<string>",
"path": "<string>",
"message": "<string>",
"fix": "<string>"
}
],
"path": "<string>",
"requestId": "<string>"
}{
"statusCode": 123,
"message": "<string>",
"path": "<string>",
"requestId": "<string>"
}{
"statusCode": 123,
"message": "<string>",
"path": "<string>",
"requestId": "<string>"
}Authorizations
The dashboard's session token (Authorization: Bearer <JWT>), as the console sends it. Never paste it into a terminal: it opens every business the user belongs to.
Path Parameters
One of your apps' ids. Another developer's app, or a malformed id, is 404 APP_NOT_FOUND.
^\d{1,20}$A secret of this app. Another app's, or a malformed id, is 404 APP_CREDENTIAL_NOT_FOUND.
1Response
The secret, state: "revoked".
A client secret, never the secret itself.
Show child attributes
Show child attributes