I'm tyring to integrate Google OAuth with Apigee and I have successfully:
- Sign in to Google
- Grab the id_token from Google and pass it as external access token to Apigee
- Access protected resource from Apigee
However, when trying to invalidate the access token upon signing out, Apigee does not completely invalidate the token. It is doing a flip flop between:
- Returning the protected resource using an invalidated access token. (Wrong)
- Returning an error "access_token_not_approved". (Correct)
Has anyone seen this behaviour before and can shed some light?
LinkedIn
Twitter
