title: Revoking Google Identity (Sign in with Google version 2022) in Server Side
body: <h1>Background</h1>
  <p>Google is kicking people <a href="https://developers.googleblog.com/2021/08/gsi-jsweb-deprecation.html" rel="nofollow noreferrer">out</a> of <a href="https://developers.google.com/identity/sign-in/web/sign-in" rel="nofollow noreferrer">Google Sign-in JavaScript library</a> (<code>platform.js</code>) and pushing people to migration <a href="https://developers.google.com/identity/gsi/web" rel="nofollow noreferrer">Sign In With Google by Google Identity Services</a> library (<code>gsi/client</code>). (<a href="https://developers.google.com/identity/gsi/web/guides/migration" rel="nofollow noreferrer">Migration Guide</a>)</p>
  <p><a href="https://i.stack.imgur.com/FtNPa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FtNPa.png" alt="enter image description here" /></a></p>
  <p>Anyone must go through this migration by March 2023.  The new flows are cool (e.g. One-tap) and should make life easier.</p>
  <p><a href="https://i.stack.imgur.com/Mgoxb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Mgoxb.png" alt="enter image description here" /></a></p>
  <h1>Problem</h1>
  <p>In the new flow, Authentication and Authorization <a href="https://developers.google.com/identity/gsi/web/guides/overview#separated_authentication_and_authorization_moments" rel="nofollow noreferrer">are separated</a>!  If you just need basic scopes (e.g. email, basic profile), then Authentication should be enough.</p>
  <p>With that, you get an ID Token (a JWT) that you can <a href="https://developers.google.com/identity/gsi/web/guides/verify-google-id-token" rel="nofollow noreferrer">verify on server-side</a>.</p>
  <p>The problem is, revoking this token (as listed in <a href="https://developers.google.com/identity/gsi/web/guides/revoke" rel="nofollow noreferrer">Revocation Methods</a>) can only be done either manually by the user in their own Google Account, or it should be done on client-side.  No server-side option is present.</p>
  <h1>The Case</h1>
  <ol>
  <li>Our platform supports sign in with Google, Apple, and email/password.</li>
  <li>The same user uses Google Sign In on Web and Apple Sign In on their iPhone. (same email address.)</li>
  <li>Per the <a href="https://developer.apple.com/support/offering-account-deletion-in-your-app" rel="nofollow noreferrer">forces of Apple, since June 30, 2022</a>, we should provide a delete account option.</li>
  <li>User signs in with Apple Sign In to our platform and requests deleting their account.</li>
  <li>We can (and must, again per Apple) revoke Sign In with Apple by calling Apple's <a href="https://developer.apple.com/design/human-interface-guidelines/patterns/managing-accounts/#deleting-accounts" rel="nofollow noreferrer">Server-to-Server Revoke Tokens endpoint</a>.  But Google doesn't provide such an option for ID-Token. :(</li>
  </ol>
  <p><a href="https://i.stack.imgur.com/gjgpQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gjgpQ.png" alt="enter image description here" /></a></p>
  <p>Any idea how to solve this?</p>