Cybersecurity glossary
What is Token Revocation?
Learn what token revocation is, how OAuth revocation endpoints invalidate access and refresh tokens, when to revoke, and design patterns for reliable logout and incident response.
Definition
Token revocation is the process of actively invalidating a previously issued security token—such as an OAuth access or refresh token—so it can no longer be used to obtain access, typically via an authorization server revocation endpoint or internal session store updates.
Why expiry alone is not a security control
Tokens eventually expire. Incidents do not wait. Token revocation gives operators and applications a way to invalidate credentials immediately after logout, offboarding, or suspected theft.
Without it, “sign out” and “disable account” become incomplete promises.
How OAuth revocation typically works
Client or admin decides to revoke
Triggered by logout, user consent removal, compromise response, or lifecycle events.
Call the revocation endpoint
Send the token (and client authentication if required) to the AS per RFC 7009.
AS marks token inactive
Refresh token and/or access token state flips; related tokens may be cascaded.
Downstream enforcement
Introspection returns active=false; gateways drop cached allows.
Force re-authentication
Next access requires a new interactive grant or valid remaining credential.
Events that should revoke
Explicit logout
End application and IdP sessions; revoke refresh tokens.
Credential changes
Password, MFA, or recovery updates invalidate old sessions.
Offboarding
Leaver flows revoke tokens across connected apps.
Consent revocation
User removes a third-party app’s access.
Security incidents
SOC kills token families after theft detection.
Refresh reuse
Rotation conflict indicates theft—revoke the family.
Revocation challenges by token design
| Design | Revoke ease | Practical approach |
|---|---|---|
| Opaque tokens + introspection | High | Flip active state centrally |
| Short-lived JWT access tokens | Medium | Rely on TTL; revoke refresh hard |
| Long-lived JWT access tokens | Low | Avoid; or maintain denylist |
| Browser session store | High | Delete server session ID |
Implementation checklist
- Implement RFC 7009 revocation and call it on logout for refresh tokens.
- Cascade revocation to related access tokens or keep access TTLs very short.
- Authenticate revocation requests to prevent cross-client abuse where required.
- On refresh-token reuse detection, revoke the entire token family.
- Wire joiner-mover-leaver systems to revoke outstanding grants.
- Ensure resource servers honor revocation via introspection or equivalent.
- Document operator playbooks for mass revoke during incidents.
- Test that UI logout actually invalidates API credentials—not only clears local storage.
The practical takeaway
Token revocation is how identity systems take back access before the clock runs out. It is essential for logout integrity, offboarding, and incident response.
Revoke refresh tokens aggressively, keep access tokens short, and make sure every resource server can learn that a credential is dead.
Related security terms
Refresh Token
Long-lived credential that must be revocable on logout and compromise.
Token Introspection
Lets resource servers learn a token is no longer active.
Token Replay
Attack window that revocation is meant to close.
OAuth Authorization Server
Component that typically hosts the revocation endpoint.
Bearer Token
Token type whose theft makes timely revocation critical.
Frequently asked questions
What is token revocation in simple terms?
It means telling the login system to cancel a token early—so logout, a stolen laptop, or a fired contractor cannot keep using old API credentials.
Which RFC defines OAuth revocation?
RFC 7009 defines OAuth 2.0 Token Revocation.
Should logout revoke refresh tokens?
Yes. If refresh tokens remain valid, ‘logout’ is cosmetic and silent renewal continues.
Why are JWTs harder to revoke?
Self-contained JWTs remain cryptographically valid until exp unless you maintain a blocklist, use short TTLs, or introspect centrally.
What should happen on password or MFA change?
Revoke existing refresh tokens and sensitive sessions so an attacker with an old token cannot persist.
Is revoking an access token enough?
Often you must revoke the refresh token (or token family) as well; otherwise a new access token can be minted.
How do resource servers learn about revocation?
Through introspection, shared revocation lists, gateway caches with short TTL, or by relying on very short access-token lifetimes.
References
Explore authoritative guidance and frameworks related to token revocation.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.