[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-token-revocation::en":3,"gloss-cluster-token-revocation::en":26,"gloss-next-token-revocation::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"token-revocation","integration","Token Revocation","Token revocation is the withdrawal of an access grant before it expires on its own. It happens for ordinary reasons: a user clicks remove access in their account settings, an administrator sweeps the third-party applications connected to a workspace, a provider invalidates tokens after a security event, or a password reset or an offboarding cascades through every session and grant attached to that person. For anyone building an integration, the fact underneath all of these is the same — the grant was never yours. It lives in somebody else's account behind a button, and the person pressing it usually does not know your product is downstream of it.\n\nWhat revocation looks like in your logs is initially indistinguishable from an expired token: authorization errors on calls that worked yesterday. The distinguishing test is the refresh. An expired access token is replaced by a refresh that succeeds; a revoked grant is one where the refresh fails too, and that failure is the actual signal. Code that treats every authorization error as a transient problem will retry a revoked connection indefinitely, which accomplishes nothing and, with some providers, counts against abuse limits.\n\nHandle it as a state, not an error. Mark the connection broken rather than deleting it, so the customer's field mappings, identifiers and history survive a reconnection instead of being rebuilt from scratch. Notify a human through a channel somebody reads, remembering that the account which lost access may belong to a person who has left the company. And stop serving the copied data as though it were current — an integration that quietly keeps showing yesterday's records after the connection died is the version of this failure that costs trust rather than merely service.\n\nThe other half is your own. Being able to revoke a credential you issued, for one customer, without a deploy, is the first capability asked for during a security incident and an uncomfortable thing to discover you lack while one is in progress.","Token revocation is a grant being withdrawn before it expires — why a failing refresh is the real signal, and why a broken connection is a state, not an error.",null,[11,14,17,20,23],{"slug":12,"name":13},"api-key","API Key",{"slug":15,"name":16},"key-rotation","Key Rotation",{"slug":18,"name":19},"oauth","OAuth",{"slug":21,"name":22},"refresh-token","Refresh Token",{"slug":24,"name":25},"service-account","Service Account",[27,31,34,38,41,44,47,50,53,56,59,62],{"slug":28,"category":5,"name":29,"updated_at":30},"api-deprecation","API Deprecation","2026-09-08T21:32:37+00:00",{"slug":32,"category":5,"name":33,"updated_at":30},"app-review","App Review",{"slug":35,"category":5,"name":36,"updated_at":37},"backend-for-frontend","Backend for Frontend (BFF)","2026-09-08T21:32:36+00:00",{"slug":39,"category":5,"name":40,"updated_at":30},"bulk-api","Bulk API",{"slug":42,"category":5,"name":43,"updated_at":37},"concurrency-limit","Concurrency Limit",{"slug":45,"category":5,"name":46,"updated_at":30},"connector-versioning","Connector Versioning",{"slug":48,"category":5,"name":49,"updated_at":30},"delete-propagation","Delete Propagation",{"slug":51,"category":5,"name":52,"updated_at":30},"effective-permissions","Effective Permissions",{"slug":54,"category":5,"name":55,"updated_at":37},"event-ordering","Event Ordering",{"slug":57,"category":5,"name":58,"updated_at":37},"field-mapping","Field Mapping",{"slug":60,"category":5,"name":61,"updated_at":37},"function-schema","Function Schema",{"slug":63,"category":5,"name":64,"updated_at":37},"grpc","gRPC"]