Removing the code is not the same as removing the access. To retire an integration, revoke its API keys and tokens, delete its webhook endpoints, remove granted scopes and provisioned users, delete stored data, and then watch logs to confirm nothing still calls it. Leftover credentials are the usual way old integrations become new incidents.
What an integration leaves behind
| Left behind | Why it matters |
|---|---|
| API keys | Still valid until revoked, even if no code uses them |
| OAuth tokens | Apps keep access until the grant is removed |
| Webhook endpoints | The vendor keeps sending data to a URL that may be unmonitored |
| Signing secrets | Anyone holding one can forge events if the endpoint stays live |
| Scopes and permissions | Remain associated with the app after features are dropped |
| Stored customer data | Retention and privacy obligations continue |
| Service accounts and SCIM tokens | Can still create or change users |
Vendor documentation supports several of these points. One messaging vendor tells you to revoke a key that is compromised or no longer used. A messaging platform notes that scopes from separate installs add up. A payment vendor notes that a deleted or disabled event destination stops future retries of an event, so removing the endpoint is how you stop deliveries.
Retirement checklist
- Announce and set a date. Tell the owners of anything that depends on it.
- Find every credential. Search the vault, CI variables and the vendor console. Use the asset inventory approach to find the ones nobody wrote down.
- Stop traffic first. Disable the webhook endpoint or pause the flow, and watch for errors that reveal hidden dependents.
- Revoke API keys and rotate any shared secret the integration also knew.
- Remove OAuth grants and uninstall apps from workspaces. Check each workspace or tenant.
- Delete webhook endpoints at the vendor and the matching routes in your code.
- Deprovision accounts. Remove service users, and revoke any provisioning token. See SCIM offboarding.
- Handle the data. Export what you need to keep, delete what you do not, and record the decision.
- Update records. Remove the vendor from your asset list and third party register, and note the date.
- Monitor for 30 days. Alert on any use of the revoked credentials. Failed attempts tell you something still depends on it, or someone is probing.
Order matters
Disable traffic before you revoke, so you learn about dependents while a rollback is still possible. Revoke before you delete code, so a mistake in cleanup does not leave live credentials behind. Delete the data last, after you know nothing needs it.
Do not forget the people side
Staff who used the integration may have credentials saved in personal password managers or notes. Ask them to remove them. For contractors, confirm access is closed. See contractor offboarding checklist.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how ongoing checks surface something that changed after a one time review.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation can help you keep the inventory current and record that the retirement steps were done. A free scan will show the dependencies that remain.
Quick check
If I delete the integration code, is the access gone?
No. Keys, tokens, webhook endpoints and grants live at the vendor until you revoke or delete them.
What should I do first?
Stop traffic, such as disabling the webhook endpoint, so you can spot dependents before you revoke anything.
Sources
- API keys, Twilio documentation
- Installing with OAuth, Slack developer documentation
- Receive events in your webhook endpoint, Stripe documentation
Last reviewed: 19 October 2026.
