Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Revoking an OAuth token is a request to its authorization server, not a universal command that instantly ends every session. What stops working—and when—depends on the token type, the issuer’s policy, and whether the services accepting the token check current revocation state. A locally validated JWT may remain usable until it expires unless the system adds a revocation check or coordination mechanism.
What does revoking a token actually do?
OAuth token revocation is defined in RFC 7009. A client sends a token to the authorization server’s revocation endpoint using HTTPS. The server invalidates the token according to its policy; resource servers that accept tokens may need to learn about that change separately.
Revocation is different from expiration, deleting a token from a device, logging out of an identity provider, or ending an application’s own session. Removing a token from local storage prevents that client from using its copy, but does not invalidate another copy. Ending an application session may leave OAuth tokens valid, and revoking an OAuth token does not necessarily clear the application’s session cookie.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRFC 7009 requires authorization servers to support refresh-token revocation and recommends support for access-token revocation. It specifies an HTTP 200 response both when a token is successfully revoked and when the submitted token is already invalid. That response therefore does not confirm that the token was valid before the request.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to request OAuth token revocation
- Identify the issuer and credential. Determine which authorization server issued the token and whether it is an access token or refresh token. Use the issuer’s trusted documentation or metadata to locate its revocation endpoint; do not send a credential to an endpoint found through an untrusted source.
- Send the token to that endpoint over HTTPS. RFC 7009 uses an HTTP POST with the token as a request parameter. A client may include a token-type hint to help the server identify the token. The exact endpoint, client authentication, and request details depend on the issuer.
- Check the issuer’s documented effects. A successful response does not establish that every resource server has stopped accepting the credential. Verify whether the issuer revokes related tokens or grants and how its services receive revocation updates.
- End any separate application session if needed. If the goal is to sign the user out of an application, terminate that application’s session as well. If the goal is to stop access across multiple services, check each service’s session and token behavior rather than assuming one logout action covers them all.
Because the request transmits a credential, protect it in transit and avoid exposing it in logs, URLs, analytics, or support messages. RFC 7009 describes invalidation as immediate at the authorization server but recognizes that propagation between servers can take time; implementations should minimize that delay.
What happens when you revoke a refresh token?
A refresh token can be exchanged for new access tokens. Revoking it primarily prevents future token issuance. If the authorization server also supports access-token revocation, RFC 7009 recommends invalidating access tokens associated with the same grant when its refresh token is revoked. Whether that cascade occurs, and which tokens or sessions it covers, depends on the server’s policy.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Modern OAuth security guidance treats refresh tokens as high-value credentials because a stolen one can be used to obtain new access tokens. RFC 9700 says authorization servers must assess whether to issue refresh tokens and, for public clients, must detect replay using sender-constrained refresh tokens or rotation. With rotation, an exchanged refresh token is invalidated and replaced; reuse of the older token can indicate compromise and may lead the server to revoke the active refresh token, requiring a new authorization grant.
RFC 9700 also allows automatic refresh-token revocation after security events, including a password change or issuer logout, and recommends expiry after a period of inactivity. These are issuer-side policies, not a guarantee that every provider handles those events identically.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Browser-based applications
For browser-based applications that receive refresh tokens, RFC 10017 requires rotation or sender constraint, plus a maximum lifetime or inactivity expiration. Rotation must not extend a pre-established initial lifetime. These controls limit how long a stolen refresh token can remain useful, but they do not make revocation semantics identical across providers.
Can a revoked JWT access token still work?
It can, depending on how the resource server validates it. A self-contained JWT carries claims and can often be validated locally using its signature and other fields. If a resource server does not check with the issuer or consult shared revocation state, the revocation endpoint alone may not tell it that the issuer has revoked the token. In that design, the token may continue to pass local checks until it expires.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For JWT access tokens that follow the profile in RFC 9068, a resource server validates matters such as token type, issuer, audience, signature, and expiration. Passing those checks establishes that the token meets the profile’s validation requirements; it does not by itself prove that the server checked current revocation state.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →JWTs are not inherently impossible to revoke. Systems can add an online revocation lookup, coordinate revocation state with resource servers, denylist tokens or grants, or use short-lived access tokens to bound the time a revoked token might remain usable. Each approach changes runtime dependencies and operational costs: local validation avoids a lookup on every request but may delay revocation, while online checks can provide fresher state but depend on that state being available and consistently enforced.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Opaque tokens and JWTs: what changes?
| Design | How a resource server checks it | Revocation effect and trade-off |
|---|---|---|
| Opaque or reference access token | The resource server may ask the authorization server or another service whether the token is active. Actual deployments vary. | Revocation can take effect when the checking service reports the changed state. This adds a runtime dependency; behavior during lookup failure depends on whether the resource server fails open or closed. RFC 7009 discusses propagation and invalidation, but does not prescribe one universal deployment design. |
| Self-contained JWT access token | The resource server can validate the signature and claims locally, following the applicable profile. | Local validation alone may not reveal revocation. Short expiry limits residual use; an online check or coordinated state can make revocation take effect sooner, with added state or runtime dependency. See RFC 7009 and RFC 9068. |
| Refresh token | The authorization server validates it when the client requests new access tokens. | Revocation prevents future issuance; associated access tokens may also be revoked under issuer policy. Rotation or sender constraint helps detect replay, with state and operational behavior determined by the implementation. See RFC 9700. |
These are design trade-offs, not a performance ranking. The practical result depends on how an issuer distributes revocation state, how often resource servers consult it, and what they do if that state cannot be reached.
What should you verify before relying on revocation?
- Scope: Does the operation revoke one token, all tokens from a grant, or additional sessions? Do not assume a cascade unless the issuer documents it.
- Propagation: Which resource servers receive revocation information, and how quickly? An issuer’s response alone does not prove that every accepting service has updated.
- JWT handling: Does the resource server perform an online check or use coordinated revocation state, or does it rely only on local signature and claim validation?
- Failure behavior: If the server cannot retrieve revocation state, does it deny the request or continue validating locally?
- Separate sessions: Are application cookies or other sessions terminated independently of OAuth token revocation?
Does RFC 7009 revoke API keys, cookies, or certificates?
No. RFC 7009 specifies OAuth token revocation, not a universal deauthorization API for API keys, TLS certificates, browser cookies, or proprietary session credentials. Their revocation behavior depends on the credential issuer and the services that accept them. For a specific system, establish whether invalidation is enforced by the issuer, by each resource server, through a shared lookup or denylist, or only when the credential expires.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
