Revoke Token call does not expired accessToken

[warren]

I believe your question is similar to this post:

Okta-jwt-verifier successfully verifies tokens even when user is logged out

I believe this is because the jwt verifier is only validating the claims in the token and whether it has expired. There isn’t information inside the token to identify whether the user has logged out. If you have security concerns, it is recommended to keep the token lifetime relatively short. An alternative is to use the /revoke endpoint to revoke the access and refresh tokens when the user has logged out of your application. Then you can use the /introspect endpoint to see whether the token …