Policy to Delete Access Tokens Associated with EndUser and/ AppID and/or TimeFrame

[#1]

Recently, I came across to a requirement where we need to delete the access token (and cascaded refresh tokens) associated with EndUser and/ AppID and/or TimeStamp.

Right now, the only option to support Enduser and AppID based deletion is to use the Management APIs. And to support the TimeStamp based deletion, first we need to get all the Tokens, Verify "issued_at" parameters associated with each and every token and then delete the tokens one by one, meeting the time frame criteria.

Although the solution works fine, but we observed a good amount of Latency there, as expected. Is there any better alternative available ?

[anilsr]

@MEGHDEEP BASU , I doubt a policy for a custom requirement. Management APIs & Async solution using nodejs exposed as an API proxy to delete "timeframe" based query may be a solution to move forward.

[#3]

@Anil Sagar,

Yes. Exactly that we have done so far. But the overall latency is high, as expected.