Revocation timing

Scopes and the reachable connection list are resolved live, on every request. Nothing about a credential is cached in the credential itself and nothing has to be refreshed.

What that buys you

Revocation is immediate. Delete a key and the next call using it gets 401 invalid_key. There is no propagation window, no token that stays valid until it expires, and no cache to wait out. If a key is in a log you can pasted into a ticket, revoking it now is genuinely now.

Narrowing is immediate too. Remove a scope from an existing key and the next call that needed it gets 403 insufficient_scope. You do not have to reissue the key to tighten it.

A new connection is visible immediately. A connection you just created shows up on the very next GET /connections. There is nothing to refresh after a provisioning step.

OAuth tokens

An OAuth access_token is the one thing with a lifetime of its own: 15 minutes. Its scopes and connection list are still resolved live, so revoking the grant stops it reaching anything immediately — but the token string itself remains syntactically valid until it expires.

refresh_token lives 30 days and rotates on use. Persist the new one atomically and serialise refreshes across workers: two workers refreshing at once will invalidate each other, and the symptom is an integration that logs out at random under load.

Webhook secrets

Rotation has no overlap window. POST /webhook/rotate issues a new secret and the old one stops verifying immediately. Deploy the new secret promptly — the delivery retry policy (3 attempts: immediate, 500 ms, 1 s) covers a rollout measured in seconds, not hours, and anything dropped in between has to be picked up by your reconciliation poll.

If you think a credential leaked

Support is written-only: email or chat.