The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →No: rotating a credential does not, by itself, prove that every copy of the old one is unusable. Rotation issues a replacement; revocation is the decision that a particular token, related token set, authorization grant, or application session is no longer valid. The critical question is which system makes that decision and which object it revokes.
Rotation and revocation answer different questions
Rotation replaces a credential with a new value, sometimes invalidating the value just used. Revocation tells the authority that verifies credentials to reject a specified token or related authorization state. A replacement value alone does not reach every verifier or invalidate every stored copy of the former value.
As an Amazon Associate I earn from qualifying purchases.
In an OAuth-based system, a credential might refer to an access token, a refresh token, or the application’s own session cookie. They are not interchangeable: they may be checked by different components and have different lifetimes. When investigating whether a credential change will end access, identify the revocation unit—the exact object or relationship the system marks invalid.
What can be revoked?
| Revocation unit | What it means | What to check |
|---|---|---|
| A single token value | The submitted token is marked invalid. Other tokens or sessions are not necessarily affected. | Whether the verifier checks revocation, or instead accepts the token until its expiry. |
| A refresh-token relationship or family | A server associates successive refresh tokens and can respond to reuse of an old value by invalidating the active token in that relationship. | Whether rotation includes reuse detection and what the server revokes when it detects reuse. |
| An authorization grant | The authorization behind a token, and potentially other tokens based on that grant, is invalidated. | Whether revoking one token cascades to related tokens and the grant. |
| An application session | The app’s authenticated browser or client session is invalidated. This is separate from invalidating an identity-provider token. | How the app ties session lifetime and logout behavior to token validity. |
| A user or account’s broader credentials | A wider administrative action may invalidate multiple sessions or credentials. | The product’s documented scope for actions such as account logout or credential reset; scope is implementation-specific. |
What OAuth refresh-token rotation does
The IETF’s OAuth 2.0 Security Best Current Practice, RFC 9700, published in January 2025, requires authorization servers serving public clients to use either sender-constrained refresh tokens or refresh-token rotation to detect replay. With rotation, a refresh operation returns a new refresh token and invalidates the one presented, while the authorization server retains information linking the tokens to their grant.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why reuse of an old token matters
If an invalidated refresh token is presented again, the server cannot know whether the legitimate client or an attacker has it. RFC 9700 says: “The authorization server cannot determine which party submitted the invalid refresh token, but it will revoke the active refresh token.” The client then needs a fresh authorization grant rather than simply continuing with that refresh-token relationship.
This is a deliberate security trade-off: rotation can expose replay, but detecting reuse may interrupt the legitimate client too. The standard also explains that a server can encode grant information in a refresh token to identify which grant and related refresh tokens need revocation; if it does so, it must preserve the token’s integrity. RFC 9700 also notes that a server may revoke refresh tokens after events such as a password change or logout at that server.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Revoking one OAuth token can cascade
RFC 7009, the IETF OAuth 2.0 Token Revocation specification, says a revocation request invalidates the submitted token and, if applicable, other tokens based on the same authorization grant and the grant itself. Implementations must support refresh-token revocation and should support access-token revocation. If access-token revocation is supported, revoking a refresh token should also invalidate access tokens based on that grant.
Free tools Windows power users keep installed
One-click scans. No signup required.
That cascade is not a universal guarantee that every token, device, or app session for a user will end. Its scope depends on the tokens’ relationship to the grant and the authorization server’s behavior. A valid analysis must ask both what was submitted for revocation and what related state that server invalidates.
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
Why an app session can outlive a token change
An application’s session is distinct from the identity provider’s OAuth tokens. For example, an app may maintain its own browser session after authenticating a user. Revoking a refresh token does not automatically invalidate that app session unless the application connects the two states and handles the invalidation.
The 2026 IETF specification RFC 10017, OAuth 2.0 for Browser-Based Applications, requires browser-based implementations that issue refresh tokens to follow RFC 9700’s rotation-or-sender-constraining rule. It also requires a maximum token lifetime or inactivity expiry and says a rotated token must not extend beyond a pre-established initial expiration. The specification recommends linking refresh-token lifetime to the authenticated session and invalidating the session when its refresh token becomes invalid.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
These distinctions explain why a password change or token rotation may not appear to log a user out everywhere: another app session may be governed separately, another grant may remain active, or a verifier may not yet know about a revocation.
“Immediate” revocation still has a propagation window
RFC 7009 describes invalidation as immediate as a protocol action, but recognizes that distributed systems may not learn about it at exactly the same moment. As the RFC puts it: “In practice, there could be a propagation delay, for example, in which some servers know about the invalidation while others do not.” It says implementations should minimize that window.
Whether an old token still works therefore depends partly on how resource servers learn that it has been revoked. Some systems check centralized state; others may accept a token until its expiry or update revocation information asynchronously. The RFC establishes the possibility of delay, not a universal duration.
How to assess a credential change or logout
- Identify the credential. Determine whether the value is an access token, refresh token, browser cookie, or another credential.
- Find the authority that validates it. The application, authorization server, and resource server may control different pieces of state.
- Establish the revocation unit. Check whether the action invalidates only one value, its refresh-token relationship, the authorization grant, an application session, or a broader set.
- Check rotation and reuse behavior. For refresh tokens, establish whether rotation is used, whether reuse is detected, and which active tokens or grants are revoked on detection.
- Check access-token behavior. Determine whether access-token revocation is supported or whether tokens remain usable until expiry.
- Check session and propagation behavior. Find out how logout or token invalidation affects app sessions and how quickly verifiers receive revocation state.
Standards specify protocol behavior, not the precise controls exposed by every service. For a particular identity provider or application, its implementation documentation is needed to establish the actual revocation scope and timing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
