Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Short answer: revoke the authorization grant through the provider’s connected-app settings when you want to remove an app’s access, or send the relevant token to the provider’s HTTPS revocation endpoint when you are building an integration. A grant is the authorization relationship; access and refresh tokens are credentials issued within it. Revoking one token is therefore not automatically the same as revoking every token or the underlying grant.
Token expiry is separate. OAuth does not prescribe one lifetime for every provider. The authorization server sets access-token and refresh-token policies, and distributed systems can continue accepting a self-contained access token briefly after revocation. The sections below explain what users and developers should expect, with GitHub’s documented credential lifetimes as a clearly scoped example.
As an Amazon Associate I earn from qualifying purchases.
What an OAuth grant is—and what you are actually revoking
An OAuth grant is the authorization relationship in which a resource owner permits a client application to access specified resources. The authorization server issues credentials under that relationship. RFC 7009 describes a token as “a string representing an authorization grant issued by the resource owner to the client.” In practical terms, the grant is the relationship, while the access token and refresh token are the working credentials.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Object | What it represents | What revoking it can affect |
|---|---|---|
| Authorization grant | The user’s consent and the server’s record connecting a client, user, scope and resource. | Potentially all credentials issued from that relationship, subject to the provider’s policy. |
| Access token | A credential presented to a resource server for API access. | That token; a server may also invalidate related credentials. |
| Refresh token | A credential used to obtain new access tokens without asking the user to authorize again. | Future token issuance and, where supported, access tokens associated with the same grant. |
| Local application session | A cookie or session record maintained by the client application. | Only that application session unless the provider documents a wider action. |
| API key or personal token | A separate credential type outside the OAuth grant. | It is not revoked merely because an OAuth authorization was removed. |
The distinction matters during incident response. Removing an app’s authorization does not automatically delete the user’s account, erase unrelated API keys, or sign the user out of every service. Ask which credential and which relationship you intend to invalidate.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do I revoke an OAuth grant as a user?
The exact labels differ by provider, but the reliable path is the provider’s own authorized-app, connected-app or application-access control. Do not rely on deleting the app from your phone or clearing a browser cookie; those actions do not necessarily change the authorization server’s record.
- Identify the provider account. Use the account that originally approved the application. If the app was approved through an organization, the organization’s administrator controls may be separate from personal settings.
- Open the provider’s authorized-application controls. Look for a page named Connected apps, Authorized applications, Applications, Integrations or a similar label in account settings.
- Find the exact client. Check the application name, publisher and scopes before acting. Similar names can represent separate OAuth clients.
- Choose the provider’s revoke, remove or deny-access control. Confirm any warning. This is the provider-side operation that changes the grant; removing a local session is not an equivalent substitute.
- Check the result from the application. A subsequent API operation should require authorization again or fail according to the provider’s documented behavior. A page that still appears open may be using a local session, a different token, or cached data.
GitHub provides a concrete example: its documentation says a user can revoke an OAuth app authorization in personal account settings, and that action revokes tokens associated with the app. GitHub documents GitHub App authorization and organization-level controls separately, so the credential type and account context must be identified before assuming what will be removed.
How does a client revoke a token?
RFC 7009 defines a revocation endpoint. The client sends an HTTPS POST containing the token and, optionally, a token_type_hint. Implementations MUST support refresh-token revocation and SHOULD support access-token revocation. Those words have their standards meaning: refresh-token support is required for conformance to the RFC, while access-token support is a strong recommendation rather than a universal guarantee.
Developer procedure
- Use the documented endpoint. Obtain the revocation endpoint from a trustworthy provider document or metadata response. Do not construct one from a guessed path, and use HTTPS.
- Authenticate the client when required. Confidential clients may need their client credentials; public clients must follow the provider’s registered method. Send only the credentials and token parameters the provider documents.
- Submit the token. A generic form-encoded request has this shape:
curl --request POST "$REVOCATION_ENDPOINT"
--header 'Content-Type: application/x-www-form-urlencoded'
--data-urlencode "token=$TOKEN"
--data-urlencode 'token_type_hint=refresh_token'REVOCATION_ENDPOINT and TOKEN are variables, not literal provider URLs or values. Use access_token as the hint when that is what you are revoking; the hint is optional and does not replace server-side validation.
- Interpret the response correctly. A successful revocation returns HTTP 200. RFC 7009 intentionally uses the same 200 response when the submitted token was already invalid, so the client must not treat 200 as proof that the token had previously been active.
- Handle a 503 response safely. A 503 means the client should assume the token may still exist. Retry after a reasonable delay according to the provider’s guidance, while avoiding an aggressive loop.
- Erase local copies. Remove access tokens, refresh tokens and cached authorization state from the client’s secure storage after submitting the request. This prevents the application from continuing to present a credential that the server may not have invalidated yet.
Does revoking a token immediately stop access?
At the authorization server, RFC 7009 says invalidation takes effect immediately, while acknowledging propagation delays in distributed deployments. The practical result depends on how the resource server validates the credential and on the provider’s policy.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Opaque tokens
An opaque access token generally requires the resource server, directly or indirectly, to check the authorization server’s state. Revocation can therefore become visible quickly, but cache settings and service-to-service propagation still matter.
Self-contained access tokens
A self-contained token, such as a signed token carrying its own claims, can be verified by a resource server without consulting the authorization server on every request. That server may accept the token until its normal expiry even after the grant or token has been revoked. RFC 7009 identifies shorter-lived access tokens and additional backend interaction as design approaches when the revocation window must be reduced.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Related credentials
Revoking one token and revoking the grant are related but not guaranteed to be identical. If an access token is revoked, the server MAY revoke its related refresh token. If a refresh token is revoked and the server supports access-token revocation, RFC 7009 says it SHOULD also invalidate access tokens based on that grant. Because these are policy-dependent rules, the provider’s documentation controls the outcome.
For a suspected compromise, revoke the grant or the broadest provider control available, then review other sessions, API keys, personal tokens and credentials. Do not promise that one OAuth action signs a user out of every service unless the provider explicitly says it does.
Do OAuth access tokens and refresh tokens expire?
Yes, tokens can expire, but OAuth supplies no universal number of minutes, hours or days. The authorization server chooses lifetimes based on credential type, risk, client type, scope and provider policy. Expiry is an automatic lifetime rule; revocation is an explicit invalidation action.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Credential | What expiry means | What the client should do |
|---|---|---|
| Access token | The resource server stops accepting it after its lifetime, subject to its validation and clock policy. | Use a valid refresh flow if one exists; otherwise send the user through authorization again. |
| Refresh token | It can no longer obtain new access tokens after its lifetime or inactivity limit. | Stop retrying it and require authorization again when the server reports invalidation. |
| Grant | The provider’s authorization relationship has been withdrawn or otherwise ended. | Discard associated credentials and obtain fresh consent if the user still wants access. |
RFC 9700 recommends inactivity expiry for refresh tokens, with the authorization server choosing the period according to policy or grant sensitivity. It also recommends risk-based decisions about whether to issue refresh tokens at all. A refresh token that expires or is revoked cannot continue supplying new access tokens, but that fact alone does not prove that every already-issued access token has stopped working at the same instant.
GitHub’s documented example
GitHub documents that GitHub App user access tokens expire after eight hours by default, while GitHub App refresh tokens expire after six months. These are GitHub’s documented values for those GitHub App credential types, checked in October 2026; they are not OAuth-wide defaults and should not be applied to GitHub OAuth Apps or another provider without documentation.
What refresh-token security controls should an application use?
Refresh tokens are long-lived by design, so their handling deserves stronger controls than a short-lived access token.
- Bind issuance to the consented scope and resources. RFC 9700 says an issued refresh token must be bound to the scope and resource servers for which consent was given.
- Rotate refresh tokens for public clients. On each use, issue a replacement and invalidate the previous token. Pair rotation with replay detection, or use sender constraint where supported.
- Store tokens securely. Keep them in the platform’s protected storage, limit access by process and role, and avoid logging raw values.
- Expect server-initiated invalidation. A provider may revoke refresh tokens after a password change, authorization-server logout or another security event.
- Stop on invalidation errors. If a refresh attempt indicates that the grant is no longer valid, do not retry indefinitely. Clear the credential and begin an authorization flow that asks the user for consent again.
Why does an app still work after I revoked access?
Several explanations are possible, and each calls for a different check.
The app is showing cached data
Local screens may display data already downloaded before revocation. Test a new API request rather than relying on an existing page.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A different credential is being used
The application may have multiple grants, a separate organization authorization, an API key or another user session. Inspect the account and credential type before concluding that revocation failed.
A self-contained access token has not expired
A resource server may validate the token locally and remain unaware of the revocation until expiry or a provider-specific synchronization event. Check the provider’s documented propagation behavior and the token’s normal lifetime.
The client did not clear its local state
Delete stored access and refresh tokens after revocation, then force a fresh authorization attempt. Otherwise the interface can appear connected even though the server-side relationship has changed.
The provider returned an intentionally ambiguous success
HTTP 200 does not reveal whether the submitted token was valid before the request. Treat the operation as idempotent, remove the local credential, and verify behavior with a new request rather than trying to infer token history from the status code.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow should applications recover after a user revokes access?
- Catch the provider’s invalid-token or invalid-grant response during API and refresh operations.
- Stop automatic retries for that credential.
- Remove the affected token and any local authorization record.
- Explain that access was withdrawn or expired and offer a new authorization link.
- Request only the scopes and resources the feature still needs.
- If the user reports compromise, direct them to the provider’s security controls and advise reviewing unrelated credentials and active sessions.
This recovery path distinguishes an authorization problem from a transient network failure. Repeating a revoked refresh-token request cannot restore consent and can create noisy, misleading logs.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Questions to ask when comparing provider controls
When documentation is ambiguous, compare providers or credential types using the same five questions:
- Does the control revoke one token, every token for an application, or the underlying grant?
- Are access tokens opaque or self-contained, and how do resource servers learn about revocation?
- What are the documented access-token and refresh-token lifetimes, including inactivity rules?
- Does the provider rotate refresh tokens, detect replay or support sender constraint?
- Do user, organization and administrator controls produce different results?
Record the answers for each provider integration. A generic statement such as “revocation is immediate” is incomplete unless it identifies which server changes immediately and when every resource server is expected to enforce that change.
Standards language worth reading carefully
RFC 7009 uses precise normative terms. “MUST” describes a required behavior for an implementation claiming the relevant conformance; “SHOULD” describes a strong recommendation that can have documented exceptions; and “MAY” permits an option. The revocation endpoint specification therefore gives clients a reliable protocol shape without promising identical grant-wide behavior at every authorization server.
“Implementations MUST support the revocation of refresh tokens and SHOULD support the revocation of access tokens (see Implementation Note).”
Use the provider’s current documentation for endpoint authentication, token-family behavior, user controls and credential lifetimes. The standard explains the protocol; it does not replace provider-specific policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
