Manage user authorized apps (grants)

App grants represent user authorization state for specific client applications.

Use grants management when users or admins need to review authorized apps and revoke app access without revoking the whole Logto session.

When grants are revoked, previously issued opaque access tokens and refresh tokens for those grants are invalidated.

Choose the right path

Scenario	Recommended path
Let signed-in users manage their own app authorizations	Account API
Let admins or support teams manage grants for a target user	Management API
Let operators manage third-party app authorizations in UI	Admin Console

Direct grant management APIs

Account API (self-service)

Use Account API in end-user account settings pages:

• GET /api/my-account/grants
• DELETE /api/my-account/grants/{grantId}
• Reference: Manage user authorized apps (grants)

Management API (admin tools)

Use Management API in admin tools and support workflows:

• GET /api/users/{userId}/grants
• DELETE /api/users/{userId}/grants/{grantId}
• Reference: Manage user authorized apps (grants)

Filter grant list by app type

Grant listing endpoints support optional query parameter appType:

• appType=firstParty: List first-party app grants only.
• appType=thirdParty: List third-party app grants only.
• Omit appType: Return all active grants.

Manage third-party app authorizations in Console

In Logto Console, use the user details page to view and revoke authorized third-party apps.

• Reference: Manage user authorized third-party apps

Revoke grants when revoking a session

When revoking a session via DELETE /api/my-account/sessions/{sessionId}, use optional query parameter revokeGrantsTarget to control grant revocation scope:

• all: Revoke grants for all apps associated with the session.
• firstParty: Revoke grants for first-party apps only.

For session-level behavior and endpoint context, see Manage user sessions and Sign-out.

Related resources

Sessions Manage user sessions

Account settings by Account API: Manage user authorized apps (grants)

Account settings by Management API: Manage user authorized apps (grants)