Revoking a credential does not always stop every service from accepting it at once. The outcome depends on the token type, the issuing authorization server, how resource servers check revocation state, and how quickly that state reaches them. For OAuth tokens, revocation usually happens at the authorization server; a locally validated JWT may remain usable until it expires unless the system adds a way to check for revocation.
What does revoking a token actually do?
Revocation tells the authority that issued a credential to stop treating it as valid. For OAuth, that is generally the authorization server. Whether an application or API stops accepting the credential immediately is a separate question: each service that consumes it must either learn about the revocation or check with a system that knows the token has been revoked.
As an Amazon Associate I earn from qualifying purchases.
Revocation is different from expiration, deleting a token from a device, logging out of an identity provider, or ending an application session. Deleting a locally stored token prevents that client from using its copy, but it does not invalidate copies elsewhere. Logging out may end one session without revoking every access token, refresh token, or session issued earlier. The actual effect depends on the issuer and consuming services.
How do you revoke an OAuth access or refresh token?
OAuth 2.0 defines a token revocation endpoint at the authorization server. A client sends an HTTP POST with the token and may include a token-type hint. The request carries a credential, so it must go to an HTTPS endpoint obtained from a trustworthy source; use the issuer’s documentation for the endpoint and required client authentication details rather than assuming a universal URL. RFC 7009, OAuth 2.0 Token Revocation, requires servers to support refresh-token revocation and recommends support for access-token revocation.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Identify which authorization server issued the token and find its documented revocation endpoint.
- Send the token to that endpoint over HTTPS using the method and client authentication required by that issuer. Include a token-type hint if the endpoint supports or expects one.
- Interpret the response according to the issuer’s documentation. Under RFC 7009, HTTP 200 is used for a successfully revoked token and for an invalid token, so the response is not a reliable way to discover whether an arbitrary token was valid.
- Check the effect at the services that accept the token. A successful response does not prove that every distributed resource server has stopped accepting it at that exact moment.
RFC 7009 describes invalidation at the authorization server as immediate, while recognizing that propagation between servers can take time and advising implementations to minimize that delay. Resource servers that do not consult the authorization server or another shared revocation source may not learn of the change through the revocation request alone.
What changes when you revoke a refresh token?
A refresh token can be exchanged for new access tokens, so revoking it primarily blocks future issuance. RFC 7009 recommends that an authorization server also invalidate access tokens associated with the same grant when it supports access-token revocation. That cascade is not guaranteed by the protocol: behavior depends on the server’s policy and implementation.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Refresh tokens warrant strong protection because possession can let someone obtain new access tokens. Under the OAuth security best current practice, authorization servers must assess whether to issue refresh tokens. For public clients, they must detect replay using either sender-constrained refresh tokens or rotation. With rotation, the previous refresh token is invalidated when a new one is issued; reuse of an old token can indicate compromise, and the server may revoke the active token, requiring the user to authorize again. The guidance also permits revocation after events such as a password change or issuer logout and recommends expiration after inactivity. RFC 9700
Free tools Windows power users keep installed
One-click scans. No signup required.
Browser-based applications
For browser-based applications that receive refresh tokens, RFC 10017, OAuth 2.0 for Browser-Based Applications, requires rotation or sender constraint, plus a maximum lifetime or inactivity expiration. Rotation must not extend a pre-established initial lifetime. These controls limit how long a stolen refresh credential can remain useful; they do not, by themselves, guarantee that already-issued access tokens have been rejected by every resource server.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Can you revoke a self-contained JWT access token?
Yes, but a revocation request alone may not make a locally validated JWT stop working. A resource server can verify a JWT’s signature and claims without contacting the issuer. If it has no online revocation check or shared revocation state, it may continue to accept a token whose signature and claims remain valid, even after the issuer has revoked it. RFC 7009 specifically notes this trade-off for access tokens.
For JWT access tokens following the OAuth profile in RFC 9068, resource servers validate properties such as token type, issuer, audience, signature, and expiration. Passing these checks establishes that the token meets the profile’s validation requirements; it does not establish that the server has checked current revocation state.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Common ways systems handle JWT revocation
- Online check: The resource server asks the authorization server or another service whether the token or grant remains active. This can provide current revocation information, but adds a runtime dependency.
- Shared revocation state: Services coordinate through a shared denylist or other revocation-state store. The system must keep that state available and ensure updates reach the services that enforce it.
- Grant or key policy: A system can use policy changes to invalidate credentials tied to a grant or signing key. The impact depends on how broadly credentials share that grant or key and how quickly the policy change reaches validators.
- Short token lifetimes: If resource servers validate JWTs locally, short-lived access tokens bound the period during which a revoked token might still be accepted. This limits residual use rather than providing immediate revocation.
How do the main token designs compare?
These are architectural trade-offs, not a performance ranking. Actual behavior depends on the issuer, resource-server implementation, and deployment.
| Design | How revocation reaches the resource server | Operational trade-off | Possible user impact |
|---|---|---|---|
| Opaque or reference token with an online status check | The resource server checks with the issuer or a shared status service; revocation can take effect as that service’s state becomes available. | Requests depend on the status service being reachable; services must define how they behave if the check fails. | A revoked token can be rejected before its original expiry when the check reflects the change. |
| Self-contained JWT validated locally | Local signature and claim checks do not convey a later revocation; a separate coordination or revocation mechanism is needed. | Validation can be stateless, but current revocation requires additional state or online coordination. Without it, expiry bounds residual use. | A token may remain acceptable until expiry unless the deployment adds a mechanism that rejects it sooner. |
| Refresh token with rotation or sender constraint | The authorization server detects replay or restricts use to the sender; revocation prevents future access-token issuance from that refresh token. | The server must manage rotation or sender-binding state and apply its replay and revocation policy. | Replay detection may revoke the active refresh token and require a new authorization grant. |
The key operational question is what a resource server does when it cannot obtain current revocation state: fail open and continue accepting a token, or fail closed and reject it. That choice affects availability as well as security, and should be explicit in the system’s design.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
What should you verify when a credential still works?
- Confirm the credential and issuer. Check whether you revoked an access token, refresh token, or another kind of credential, and whether the endpoint belonged to the issuer that created it.
- Check the enforcement path. Determine whether the resource server performs an online check, reads shared revocation state, or validates a JWT locally.
- Allow for propagation. A distributed deployment can take time to propagate revocation state; a successful endpoint response is not proof that all consumers have updated.
- Consider related credentials. Ask whether the issuer revokes access tokens linked to the refresh token or grant. RFC 7009 recommends that cascade in the specified case, but server policy determines the actual behavior.
- Separate application sessions from tokens. An app may maintain its own session after an OAuth token is revoked, or may end that session without revoking credentials held elsewhere.
- For JWTs, check the enforcement design. If validators only check the signature and claims, confirm whether short expiry, an online status check, or another system-specific mechanism is intended to stop use before expiry.
Do API keys, cookies, and certificates use the same revocation process?
No universal revocation operation is established for API keys, TLS certificates, browser cookies, or proprietary session credentials. Their behavior depends on the issuer and the services that consume them. Find out whether invalidation is enforced by the issuer, by each consuming service, through a shared status mechanism, or only when the credential expires. OAuth’s RFC 7009 endpoint is for OAuth tokens, not a cross-vendor revocation API for every credential type.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
