Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

revokeToken is confusing #157

Open
Remscar opened this issue Oct 4, 2024 · 0 comments
Open

revokeToken is confusing #157

Remscar opened this issue Oct 4, 2024 · 0 comments

Comments

@Remscar
Copy link

Remscar commented Oct 4, 2024

ATTENTION

This issue template is for bugs or documentation errors in this SDK Repo. Please direct all technical support questions, feature requests, API-related issues, and general discussions to our Square-supported developer channels. For public support, join us in our Square Developer Discord server or post in our Developer Forums. For private support, contact our Developer Success Engineers directly.

Describe the bug
The api design for OAuthApi.revokeToken is confusing

async revokeToken(

Expected behavior
I was using the revokeToken in the oauth api to revoke all tokens and I had no issue. Then when I started using it to revoke a single token I started getting a "bad authorization header" error back.

After checking out the Square SDK source code I realized my assumption that "Client " is automatically prepended onto the authorization header was false.

The documentation does state that it needs to be in the format: Authorization: Client APPLICATION_SECRET however it's a bit confusing in the way it states this:

 * __Important:__ The `Authorization` header for this endpoint must have the
 * following format:
 *
 * 
 * Authorization: Client APPLICATION_SECRET
 * 

The user for this function is not manually manipulating headers (or authorization headers). The API of the function asks for

authorization: string

Whose comment is @param authorization Client APPLICATION_SECRET

It would be simpler if it simply asks for the client application secret, and not for the client application secret with "Client " prefixed onto it.

Alternatively you could rename authorization to authorizationHeader so it's clear that the user is passing in the entire header line, not just the application secret. Most other SDK's that do similar things don't require the user to pass in the "Client " part.

Square SDK version
For example: 38.1.0

Additional context

async revokeToken(

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant