# User account refresh token revocation

**URL:** <https://devforum.okta.com/t/user-account-refresh-token-revocation/21159>\
**Category:** Questions\
**Created:** [July 5, 2022, 1:12pm UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159 "2022-07-05T13:12:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![DenisR](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@DenisR](https://devforum.okta.com/u/DenisR)\
**Post date:** [July 5, 2022, 1:12pm UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159/1 "2022-07-05T13:12:30Z")

</div>

Hi.  
We are using refresh tokens for our user accounts in out OKTA tenant constantly to get access tokens and configure our refresh tokens expirations to be 90 days. My question is: is it possible that my refresh token could be revoked by OKTA (by some reason) before the expiration that I configured?

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [July 6, 2022, 10:51pm UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159/2 "2022-07-06T22:51:16Z")

</div>

Yes, administrators can revoke your refresh token if required

---

<div class="post-metadata">

**Author:** ![DenisR](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@DenisR](https://devforum.okta.com/u/DenisR)\
**Post date:** [July 10, 2022, 12:05pm UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159/3 "2022-07-10T12:05:15Z")

</div>

Hi Philipp and thank you for reply. Let me clarify please, your answer means that OKTA administrators could revoke my refresh tokens by their own (OKTA) decision, or by my request?

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [July 10, 2022, 10:54pm UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159/4 "2022-07-10T22:54:11Z")

</div>

Hi Denis, your administrators can remove your token by their decision in case of any security related incident, or when your user is offboarded from the tenant.

---

<div class="post-metadata">

**Author:** ![DenisR](https://avatars.discourse-cdn.com/v4/letter/d/59ef9b/32.png) [@DenisR](https://devforum.okta.com/u/DenisR)\
**Post date:** [July 12, 2022, 11:20am UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159/5 "2022-07-12T11:20:16Z")

</div>

Hi, I know that, but my question was about OKTA administrators. Is it possible that my tokens will be revoked by OKTA not by request from me or my company administrators? For example in case when some security issue discovered by OKTA that needs to revoke lets say all customers refresh tokens.

---

<div class="post-metadata">

**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\
**Post date:** [July 12, 2022, 12:14pm UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159/6 "2022-07-12T12:14:48Z")

</div>

Do you mean, Okta Support Team? I doubt that they would do that, or if they have this ability.

But if you need an official answer it’s better to raise a ticket with Okta Support or ask your Okta CSM.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 13, 2024, 4:45pm UTC](https://devforum.okta.com/t/user-account-refresh-token-revocation/21159/7 "2024-02-13T16:45:24Z")

</div>