Invalidating an access token when user logs out

Hi @Sargent_D

Access tokens cannot be invalidated: they are designed to be self contained, not requiring a check with Auth0 to validate, so there is no way to invalidate them.

For this reason, access tokens should have a short lifetime.

When your FE application logs the user out, it should discard the access token to prevent further activity. This is not foolproof of course, for that you need shortlived access tokens.

John

3 Likes