How can an admin revoke the access token for a user?

[markd]

Hello @shadymohammed,

Welcome to the Community! I may be wrong but I don’t believe you can revoke access tokens at all in Auth0, at least not yet (you can revoke a refresh token). The recommended best practice is to keep your token lifetime short. @nicolas_sabena suggests an approach here:

Best practice for checking if token is revoked in API

Hi @craig3 With OAuth2, a client application receives an Access Token that lets the application access a resource (the API) on behalf of the user (there might be a consent step involved if the application is considered “third-party”). If a user logs out of the application, that action alone does not (should not) invalidate the issued token, because the user already gave consent to the application to access the resource. If anything, the application should discard any tokens previously obtained…