# Stop a sign-in

**POST** `/api/connections/oauth2/attempts/{attemptId}/cancel`

Stops a sign-in you started, so finishing it later connects nothing.

Needs [an API token](https://docs.gorunner.io/api/authentication#scopes) with the **Write** permission for connections (`connection:write`).

## Parameters

### Path

- `attemptId` · Required · string: The sign-in to stop.

## Responses

- 200 OK

  The sign-in as it stands now, as **Check a sign-in** reads it. One that had already ended keeps its outcome. One that is gone answers `{"status": "expired"}`.

- 403 `FORBIDDEN`

  The token lacks the **Write** permission for connections.

- 404 `NOT_FOUND`

  Not a sign-in you started.

- 500 `INTERNAL_ERROR`

  The sign-in couldn’t be stopped. Try again.

- 503 `UNAVAILABLE`

  This server can’t reach sign-ins now.

Any call can also answer: [`401 UNAUTHORIZED`](https://docs.gorunner.io/errors#UNAUTHORIZED) · [`401 TOKEN_ENDED`](https://docs.gorunner.io/errors#TOKEN_ENDED) · [`403 TOKEN_SURFACE_OFF`](https://docs.gorunner.io/errors#TOKEN_SURFACE_OFF) · [`403 FEATURE_OFF`](https://docs.gorunner.io/errors#FEATURE_OFF) · [`403 EMBED_NOT_ALLOWED`](https://docs.gorunner.io/errors#EMBED_NOT_ALLOWED) · [`403 EMBED_NOT_AVAILABLE`](https://docs.gorunner.io/errors#EMBED_NOT_AVAILABLE) · [`403 ACCOUNT_SUSPENDED`](https://docs.gorunner.io/errors#ACCOUNT_SUSPENDED) · [`413 PAYLOAD_TOO_LARGE`](https://docs.gorunner.io/errors#PAYLOAD_TOO_LARGE) · [`415 INVALID_CONTENT_TYPE`](https://docs.gorunner.io/errors#INVALID_CONTENT_TYPE) · [`429 RATE_LIMITED`](https://docs.gorunner.io/errors#RATE_LIMITED) · [`503 BUSY`](https://docs.gorunner.io/errors#BUSY) · [`503 PAUSED`](https://docs.gorunner.io/errors#PAUSED) · [`503 SERVICE_UNAVAILABLE`](https://docs.gorunner.io/errors#SERVICE_UNAVAILABLE). See [Errors](https://docs.gorunner.io/api/errors#by-status).

Request

**curl**

```bash
GORUNNER="https://api.gorunner.io"
GORUNNER_TOKEN="grt_…"  # needs Write for connections
ATTEMPT_ID="your-attempt-id"  # from the start

URL="$GORUNNER/api/connections/oauth2/attempts/"
URL="${URL}$ATTEMPT_ID/cancel"
curl -X POST "$URL" \
  -H "Authorization: Bearer $GORUNNER_TOKEN"
```

**JavaScript**

```js
const GORUNNER = "https://api.gorunner.io";
const TOKEN = process.env.GORUNNER_TOKEN;
const ATTEMPT_ID = process.env.ATTEMPT_ID; // from the start

const res = await fetch(
  `${GORUNNER}/api/connections/oauth2/attempts/` +
    `${ATTEMPT_ID}/cancel`,
  {
    method: "POST",
    headers: { Authorization: `Bearer ${TOKEN}` },
  },
);
const { data } = await res.json();
```

**Python**

```python
import os, requests

GORUNNER = "https://api.gorunner.io"
TOKEN = os.environ["GORUNNER_TOKEN"]
ATTEMPT_ID = os.environ["ATTEMPT_ID"]  # from the start

res = requests.post(
    f"{GORUNNER}/api/connections/oauth2/attempts/"
    f"{ATTEMPT_ID}/cancel",
    headers={"Authorization": f"Bearer {TOKEN}"},
)
data = res.json()["data"]
```

Response · 200 OK

```json
{
  "data": {
    "attemptId": "Zq3XbN0iJm7dQe8TfR2wLg",
    "status": "failed",
    "reason": "cancelled",
    "error": "You stopped this sign-in.",
    "expiresAt": "2026-10-25T09:10:00Z"
  }
}
```

**Every field**

It takes no body.

### Response · 200 OK, a sign-in from GoRunner’s own pages

- `data` · object
  - `status` · string: `pending` — the popup has not bound yet; `launched` — the person is at the provider; `connected` — the tokens are stored; `failed` — see `error`; `expired` — the attempt aged out, or never existed. One of `pending`, `launched`, `connected`, `failed`, `expired`.
  - `connectionId` · UUID: The connection signed in: for a sign-in that makes its connection, present once it connected.
  - `reason` · string: Only when `failed`: `denied` — the person said no on the provider’s page; `other_window` — the sign-in finished in a browser that did not start it; `service_error` — the provider answered with an error; `failed` — anything on this side (the connection, its client, storage). One of `denied`, `other_window`, `service_error`, `failed`, `cancelled`.
  - `error` · string: Only when `failed`: why it ended, as a sentence for a person.
  - `account` · string: Only when `connected`: who signed in, when the test after the sign-in named them.
  - `previousAccount` · string: Only when a sign-in again signed in as someone else than before: who it was.
  - `accountChanged` · boolean

### Response · 200 OK, a sign-in an API token started

- `data` · object
  - `attemptId` · string
  - `status` · string: `pending` — the provider has not sent the browser back yet; `connected` — the connection holds its tokens; `failed` — see `reason`. One of `pending`, `connected`, `failed`.
  - `connectionId` · UUID: Only when `connected`: the connection made (or signed in again).
  - `reason` · string: Only when `failed`: `denied` — the person said no on the provider’s page; `service_error` — the provider answered with an error; `failed` — anything on this side; `cancelled` — the sign-in was stopped (`POST /api/connections/oauth2/attempts/{attemptId}/cancel`, by the token that started it; no partner endpoint stops one); `expired` — the link ran out first. One of `denied`, `service_error`, `failed`, `cancelled`, `expired`.
  - `error` · string: Only when `failed`: why, as a sentence for a person.
  - `account` · string: Only when `connected`: who signed in, when the test after the sign-in named them.
  - `expiresAt` · time

Related: [Check a sign-in](https://docs.gorunner.io/api/connections/get-connection-oauth2-attempt-any)

Source: https://docs.gorunner.io/api/connections/cancel-connection-oauth2-attempt