We have written a Revoke access token API that deals with revoking an access token and a refresh token. We're using OAuthV2 policy with 'InvalidateToken' operation and the cascade attribute is set to true. We've noticed that once a token is successfully revoked, it takes a few seconds before it is made unusable (sometimes up to ~ 7 seconds). Is that normal and expected? What would be the maximum time it'll take before the token is invalid?
LinkedIn
Twitter
