title: How to validate the apple sign in revoke token api successfully when handle delete account on iOS?
body: <p>Per <a href="https://developer.apple.com/news/?id=12m75xbj" rel="nofollow noreferrer">Account deletion requirement iOS</a></p>
  <blockquote>
  <p>If your app offers Sign in with Apple, you’ll need to use the Sign in with Apple REST API to revoke user tokens when deleting an account.</p>
  </blockquote>
  <p>Referring to this <a href="https://stackoverflow.com/a/72498906/3011380">answer</a>, we are trying to send this revoke token API on our server-side. Here are some snippet</p>
  <pre class="lang-js prettyprint-override"><code>        privateKey = fs.readFileSync(&quot;xxxxxxxx.p8&quot;)
          client_secret = jwt.sign({ 
                  iss: 'xxxx-xxx-xx-xxxx-xxxxxxxx',
                  iat: Math.floor(Date.now() / 1000),
                  exp: Math.floor(Date.now() / 1000) + 1200,
                  aud: 'https://appleid.apple.com',
                  sub: &quot;sample.com&quot;
              }, 
              privateKey, 
              { 
                  algorithm: 'ES256',
                  header: {
                      alg: 'ES256',
                      kid: 'xxxxxxxxxxx'
                  } 
              });
  
          data = {
              'token': token,
              'client_id': &quot;sample.com&quot;,
              'client_secret': client_secret
          };
          body = qs.stringify(data)
  
          opts =
              protocol: 'https:'
              host: 'appleid.apple.com'
              path: '/auth/revoke'
              method: 'POST'
              timeout: 6000
              headers:
                  'Content-Type': 'application/x-www-form-urlencoded'
                  'Content-Length': Buffer.byteLength(body)
         // call https to send this opts message
  </code></pre>
  <p>And the status code of the above codes could be 200 and the response body is empty.</p>
  <p>However, the response code 200 of <a href="https://developer.apple.com/documentation/sign_in_with_apple/revoke_tokens" rel="nofollow noreferrer">revoke token api</a></p>
  <blockquote>
  <p>The request was successful; the provided token has been revoked successfully or was previously invalid.</p>
  </blockquote>
  <p>It seems the status code 200 includes the provided token was previously invalid. How could we distinguish whether the revoke token API was returned by the invalid token or revoked successfully?</p>
  <p>We also try to test this revoke token API through <code>curl</code> with invalid <code>client_secret</code> and <code>token</code>, the status code 200 could be returned either and the response body is empty. It is so weird.</p>
  <pre><code>curl -v POST &quot;https://appleid.apple.com/auth/revoke&quot; \
  -H 'content-type: application/x-www-form-urlencoded' \
  -d 'client_id=xxx.xxxx.yyyy' \
  -d 'client_secret=ddddddeyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IlBGUVRYTTVWUlcifQ.dddd.DmMifw6qWHMqKgDIbO8KrIzDvbF7T4WxxEo9TmtN0kmTISsi8D8FG52k_LPGkbNEnS_-w_SRimEKIH1rsuawFA' \
  -d 'token=dddddd' \
  -d 'token_type_hint=access_token'
  
  &gt; POST /auth/revoke HTTP/1.1
  &gt; Host: appleid.apple.com
  &gt; User-Agent: curl/7.77.0
  &gt; Accept: */*
  &gt; content-type: application/x-www-form-urlencoded
  &gt; Content-Length: 240
  &gt;
  * Mark bundle as not supporting multiuse
  &lt; HTTP/1.1 200
  &lt; Server: Apple
  &lt; Date: Thu, 09 Jun 2022 07:36:31 GMT
  &lt; Content-Length: 0
  &lt; Connection: keep-alive
  &lt; Host: appleid.apple.com
  </code></pre>