Tokens and credentials
Token revocation
A standard endpoint that lets a client tell the authorization server a token is no longer needed and must stop working.
What Token revocation means
Token revocation (RFC 7009) is an endpoint where a client sends a refresh or access token it no longer needs — typically at sign-out — and the authorization server invalidates it. Revoking a refresh token should also invalidate access tokens and further refresh tokens derived from the same grant.
Defined in: RFC 7009 — OAuth 2.0 Token Revocation.
How it works
Revocation is how a client cleans up after itself: on logout, on uninstall, when a user disconnects an integration. Without it, a refresh token stored on a lost device remains valid until it expires.
Whether revocation affects already-issued self-contained JWT access tokens depends on whether resource servers check state. A JWT validated only by signature stays valid until its exp.
The mistake people actually make
Calling revocation on the access token and assuming the session is over. The refresh token is the long-lived credential; revoke that.
In Authreads
How this applies here
Authreads exposes a revocation endpoint that revokes a refresh token's whole family.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Related terms
Refresh token
A long-lived credential used to obtain new access tokens without the user re-authenticating.
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
Token introspection
An endpoint where a resource server asks the authorization server whether a token is active and what it grants.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.