Access tokens: what they are and 5 cases for revoking them
The short answer: an access token is a temporary credential that an app receives when you authorise it, instead of your password, and it only allows what you agreed to. Being able to revoke it matters because you can cut off a specific app's access without changing your password or affecting any others, for example if you lose a phone or stop using the app.
What an access token is and how it differs from your password
An access token is a string of characters that your account provider (Google, Microsoft, Apple or another) gives to an app when you grant it permission. The app presents it with every request, and the provider checks what it is allowed to do with it.
It differs from your password in three ways:
- Limited scope: the token only covers the permissions you accepted, for example reading your calendar but not deleting emails. Your password opens the entire account.
- One app, one token: every app you authorise gets its own. If you withdraw one, the others carry on working.
- The app never sees your password: you sign in on the provider's page and the app only receives the token.
If you'd like to understand the full journey of an authorisation, the article on what data you share when authorising explains it step by step.
Access tokens and refresh tokens: why there are two
Most services issue two separate credentials: a short-lived access token and a long-lived refresh token. The access token expires quickly, after a period set by each service; when it does, the app uses the refresh token to request a new one without bothering you.
This design has a practical consequence: even if someone steals an access token, it's of little use to them for long. The one that really keeps the connection open is the refresh token, and that is the one invalidated when you revoke an app's access from your account. That's why revoking works even if the access token hasn't expired yet: as soon as it runs out, the app can no longer renew it.
Changing your password doesn't always invalidate tokens that have already been issued; it depends on the service. If you're suspicious of an app, explicitly revoke its access as well as changing your password.
5 cases in which you should revoke an access token
Revoking is the right step when the problem lies with a specific app or device, not with the whole account.
| Situation | What to revoke | What else to do |
|---|---|---|
| You lose or sell a phone | The apps you had authorised on it | Sign that device out of your account |
| You stop using an app | All of its access | Ask it to delete your data if you wish |
| The app asks for more permissions than it needs | Its access, then reauthorise with fewer | Check whether there's a less intrusive alternative |
| You get an alert about access you don't recognise | Every app you can't identify | Change your password and review two-step verification |
| An app behaves oddly or stops syncing | Its access, then connect it again | Check whether the fault persists after reconnecting |
The last case isn't about security but maintenance: reconnecting issues new tokens and fixes quite a few problems. The guide to signs of broken sync helps you tell it apart from other causes.
How to revoke an access token in Google and iCloud
In Google, you review and remove other apps' access under Google Account → Security → ‘Your connections to third-party apps and services’. Microsoft and other providers have an equivalent page in their account settings. The general process is as follows:
- Open your account's security page: always get there by typing the address yourself, not from a link you received by email.
- Find the app by name: if you don't recognise it, it's a candidate for revoking.
- Remove access: the provider invalidates its tokens and the app loses the connection.
- Reauthorise only if you need it: when you reconnect, review the permissions it asks for.
iCloud Mail works differently. To read it from a third-party app you need an app-specific password, which you create at account.apple.com with two-step verification turned on. That password plays the role of a token: it's specific to one app and managed in the same place, without touching your Apple Account's main password.
What happens in an app after you revoke its token
The app can no longer read from or write to your account, but it keeps whatever it had already downloaded until it deletes it. Revoking cuts off future access; it doesn't remove data copied beforehand.
In practice you'll notice the account stops updating: new email doesn't appear, appointments stay as they were or the app asks you to connect again. The same goes for any service that combines several accounts, Madrugo included: if you remove access to Gmail or Google Calendar, that account stops being kept up to date until you connect it again.
If you want the app to delete what it stored, you have to ask it to. The GDPR gives you the right to access your own data and to request its deletion, and whoever processes it must respond within one month, extendable by a further two months if the request is complex. Madrugo's privacy policy sets out what is stored and how to request its deletion.
Frequently asked questions
- Is an access token the same as a password?
- An access token is not a password. It's a credential the provider gives to a single app, limited to the permissions you accepted. A password opens the entire account, whereas the token only works for that app and can be revoked without changing anything else.
- If I change my Google password, are my apps disconnected?
- Changing your Google password doesn't guarantee that all authorised apps are disconnected, because it depends on the type of access. To cut off a specific app, remove it under Google Account, Security, Your connections to third-party apps and services.
- What happens to my data if I revoke an app's access?
- Revoking an app's access stops it from reading or changing your account, but it doesn't delete anything it had already copied. To have that data removed you need to request it from the app; the GDPR requires a response within one month, extendable by two months if the request is complex.
- How do I revoke an app's access to iCloud Mail?
- An app's access to iCloud Mail relies on an app-specific password created at account.apple.com with two-step verification turned on. Revoking that app-specific password on the same page cuts off that app's access without changing your Apple Account password.
- Does revoking and reconnecting an app fix syncing?
- Revoking and reconnecting an app that isn't syncing usually fixes credential faults, because the provider issues new tokens. If the problem continues after reconnecting, the cause lies elsewhere, such as the app itself, the network or the source service.