# Invalidating Tokens that users post

**URL:** <https://discuss.dev.twitch.com/t/invalidating-tokens-that-users-post/20757>\
**Category:** Meta\
**Created:** [April 4, 2019, 8:43pm UTC](https://discuss.dev.twitch.com/t/invalidating-tokens-that-users-post/20757 "2019-04-04T20:43:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheElm](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/theelm/32/2911_2.png) [@TheElm](https://discuss.dev.twitch.com/u/TheElm)\
**Post date:** [April 4, 2019, 8:43pm UTC](https://discuss.dev.twitch.com/t/invalidating-tokens-that-users-post/20757/1 "2019-04-04T20:43:10Z")

</div>

Are there any rules or restrictions against using Discourses native API here on the developer forums?

I see a lot of users who accidentally post their access tokens in their posts, and get warned by other users that they should invalidate them. It’d be a fun little side project to occasionally scan for new posts using the built in API and invalidating them with [Twitchs API](https://dev.twitch.tv/docs/authentication/#revoking-access-tokens) to prevent malicious activity.

Gotta stay safe out there 🕶

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [April 4, 2019, 9:43pm UTC](https://discuss.dev.twitch.com/t/invalidating-tokens-that-users-post/20757/2 "2019-04-04T21:43:12Z")

</div>

This topic was automatically closed 60 minutes after the last reply. New replies are no longer allowed.