domainwidedelegation.comStart free

Use cases → Admin and governance

Bulk remove third-party app OAuth grants domain-wide

Revoke OAuth tokens for unwanted apps across all users, cleaning up old integrations and reducing risk in one operation.

Who it is forWorkspace administrators responsible for security and compliance.
APIsAdmin SDK
Typical scopesadmin.directory.user.security

The problem

Over years, dozens of third-party apps accumulate persistent access to user data. Manual removal is infeasible at scale, and a single missed grant can leave a critical hole. Audit results are only useful if you can act on them quickly.

How it works

  1. Enumerate all users in the domain via the directory API.
  2. For each user, list their OAuth grants using the Admin SDK.
  3. Identify the client IDs or app names to be removed.
  4. Call the tokens.delete method for each unwanted grant per user.
  5. Log revocation results and recheck to confirm removal.

What changes

Unwanted third-party access is revoked for every user, closing off lingering access and reducing audit workload for the future.

The trap in this one. tokens.delete returns 204 No Content even if the token is already gone or never existed, which means your logs will show success even when nothing changed. If you run this in parallel across thousands of users, you can hit Admin SDK rate limits that are not documented precisely—expect HTTP 429s and exponential backoff. Revocations can take several minutes to propagate, so querying immediately after may show stale results.

Questions people ask

Can users still re-authorise these apps after bulk removal?

Yes, unless you also block the app in the admin console. Revoking tokens only removes current access, not future authorisations.

Is there a way to get a definitive 'was this token actually deleted?' response?

No. The API does not distinguish between a successful deletion and a no-op; both return 204. You must cross-check by re-listing tokens after a delay.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.