Home / Knowledge hub / Token revocation
Knowledge hub
Token revocation
Cancelling a token before it expires, for example after a password change.
What it means
Token revocation is the act of cancelling a token before its natural expiry, so the server refuses it from then on. OAuth 2.0 has a standard way to ask for it: a revocation endpoint defined in RFC 7009, where a client sends the token it wants to be cancelled.
Expiry is a safety net. Revocation is the emergency brake. You need it when something has gone wrong and waiting for the clock is not acceptable, such as after a stolen device or a takeover.
Why it matters
Think of a laptop stolen with a signed-in app, an employee who has just left, or a password reset after an account takeover. If tokens keep working for another hour or another month, the owner has done everything right and the thief still has access.
Short expiry lowers the cost of not having revocation, but never removes it. Long-lived refresh tokens especially need a way to be cancelled, because they can keep producing new access tokens.
How it shows up
Opaque tokens are easy to revoke: delete the record. Self-contained tokens such as JWTs are harder, as the server checks the signature and expiry without looking anything up. Teams add a denylist, a per-user version number or very short lifetimes.
The mistakes repeat. A revocation endpoint that returns success but does nothing. Revoking the access token and leaving the refresh token. No revocation on password change, role removal or user deletion. Test by using a token after each of those events.
Questions people ask
Token revocation, answered
What is the difference between revoking and expiring?
Expiry happens by itself at a set time. Revocation is a deliberate act that ends a token early.
You want both: expiry as the default, revocation for exceptions.
How do you revoke a JWT?
Not directly, since it is self-contained. Common approaches are a denylist of token ids, a stored per-user token version, or a short lifetime paired with revocable refresh tokens.
Each adds a server-side lookup, which is the price of control.
When should tokens be revoked automatically?
On logout, password change, MFA reset, role removal, account suspension and when a refresh token is reused unexpectedly.
Reuse of a rotated refresh token is a sign of theft.
Does RFC 7009 make revocation mandatory?
No. It defines how a client asks the authorisation server to revoke a token. Whether a server supports it, and how fast it takes effect, is up to the implementation.
Check what your provider actually does.
How do we test revocation?
Obtain a token, trigger the event (logout, reset, removal), then call a protected endpoint with the old token.
Any success is a finding, and a pentest report shows the call and its response.
Sources
Where this comes from
Related
Terms that sit next to this one
Refresh token
A long-lived token used to get new short-lived access tokens without signing in again.
Access token
A short-lived token that lets a client call an API on a user's behalf.
JWT
A signed token a client carries to prove who is signed in.
Logout invalidation
Making sure signing out really kills the session on the server, not just in the browser.
JWT expiry
The time claim that stops a signed token from being accepted forever.
Does an old token still work?
Tokens that keep working after a password change, a logout or a role removal are something we try on the running app, and we report only what we used. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.