OAuth and third-party app grants viewable and individually revocable

OAuth app grants that cannot be individually revoked give third-party applications permanent access to a user's account unless the user changes their password — a drastic action that breaks all legitimate sessions. GDPR Art. 7(3) requires withdrawal of consent to be as easy as giving it; if consent was given by authorizing an OAuth app, revocation must be available at the same granularity. CWE-285 and OWASP A01:2021 classify unrevocable authorization grants as access control failures. A user who suspects an app is misusing their data has no recourse short of a full password reset.

Build a connected apps management page in account settings. List all active OAuth grants with app name, granted scopes, and grant date. Provide a per-app revoke button that immediately invalidates the access token in your database. In src/app/settings/connected-apps/page.tsx:

async function revokeOAuthGrant(appId: string, userId: string) {
  await db.oauthGrant.deleteMany({
    where: { appId, userId }
  });
  // Invalidate any active tokens for this grant
  await db.oauthToken.deleteMany({
    where: { appId, userId }
  });
}

Display the scopes each app was granted in plain language (e.g., 'Read your posts', 'Send messages on your behalf') — not raw OAuth scope strings — so users can make informed revocation decisions.