Answers · agent controls
How do I revoke an AI agent's access immediately?
Last updated
TL;DR: Revoke at the source that issued each credential, starting with the ones that can mint new access: OAuth refresh tokens and grants, app installations, then personal access tokens and API keys. Then deal with what revocation doesn't stop. An OAuth access token that's already been issued can keep working until it expires if the service checks tokens locally: RFC 7009 warns that if a server doesn't support access-token revocation, access tokens aren't invalidated when their refresh token is revoked, and Microsoft Entra access tokens default to 60-90 minutes. Some revocations also leave side doors open, like SSH keys a GitHub token created. 'Immediately' really means: revoke everything the agent holds, block it in a layer you control while short-lived tokens expire, and confirm with a test call that it's locked out.
What should I check, step by step?
1. List everything the agent holds: OAuth grants (Google, GitHub, Slack, Microsoft), app installations, personal access tokens, API keys, SSH keys, cloud credentials, payment cards and any credentials it saved to disk or a secrets store.
- Revoke what can create new access first: refresh tokens and OAuth grants, app installations, then long-lived keys and tokens. A revoked access token is little use if a live refresh token can mint another.
- Use the issuing service's revocation, not just deleting the token on your side: Google's https://oauth2.googleapis.com/revoke, GitHub's app authorization and token endpoints or settings pages, Slack's auth.revoke, Microsoft Graph revokeSignInSessions.
- Cover the gap until short-lived tokens expire: block the agent in your own gateway, proxy or tool layer, where the decision takes effect on the next call.
- Look for side doors: SSH keys or deploy keys the agent added, webhooks it registered, new API keys it created, and scheduled jobs or second workers that will restart it with the same secrets.
- Stop the trigger too: disable the schedule, queue consumer or CI workflow that starts the agent, or it may start again with whatever credentials it still has.
- Test it: make a call with each old credential and confirm it's refused, then check the services' audit logs for activity after the revocation time.
- Write down what you revoked and when, so you can explain the timeline later and know exactly what to reissue if the agent goes back to work.
How revocation works at common providers (checked Oct 30, 2026)
Google: an app can POST the token to https://oauth2.googleapis.com/revoke; the token can be an access or refresh token, and revoking an access token that has a refresh token revokes the refresh token too. Google says revocation removes all scopes granted to the project, invalidating issued access and refresh tokens for all of its clients. Users can also remove an app's access in their Google Account settings.
- GitHub: OAuth and GitHub App owners can delete a user's app authorization, which deletes all of the app's OAuth tokens for that user, or delete a single token. A GitHub App installation can be uninstalled, or suspended if you may restore it; installation access tokens expire after 1 hour. Organization owners can revoke fine-grained personal access tokens, but GitHub notes that SSH keys created by a revoked token keep working and the token can still read the organization's public resources.
- Slack: auth.revoke revokes the token passed to it and returns revoked: true. Revoking a bot token deactivates the bot user and removes its channel memberships but doesn't uninstall the app.
- Microsoft Entra: revokeSignInSessions invalidates a user's refresh tokens and browser session cookies, and Microsoft says there may be a delay of a few minutes. Access tokens already issued have a default lifetime of 60-90 minutes, so until they expire, block the agent elsewhere unless the client and resource support Continuous Access Evaluation.
Why revoked isn't always gone
RFC 7009 says the authorization server invalidates a revoked token immediately, but allows a propagation delay between servers, and that self-contained access tokens can be checked by a resource server without asking the authorization server. Those keep working until they expire.
- Short token lifetimes are what make revocation fast in practice: an agent holding 15-minute access tokens and a revocable refresh token is cut off far sooner than one holding a long-lived API key.
- One credential per agent keeps the blast radius small. If the agent shares your personal token, revoking it locks you out as well, and that delay is often why people don't revoke quickly.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “My agent is misbehaving. Revoke its Rightshold credential now so every Rightshold check refuses it, reason compromised_key.”
{
"tool": "revoke_agent",
"arguments": {
"subject_id": "crd_YOUR_AGENT_CREDENTIAL",
"reason": "compromised_key",
"note": "token leaked in a log, revoking at Google and GitHub too"
}
}- Needs your owner account key; it's in the trust toolset (connect to /mcp?toolset=trust). Revocation is irreversible: to put the agent back to work, issue it a new credential with a new key. Anyone can check it for free with check_revocation, or follow GET /v1/revocations?since= and the signed list at GET /v1/revocations/signed.
- If your tool layer sends the credential id as agent in POST /v1/guard/check, guard checks for a revoked credential deny from then on, so actions your code routes through Rightshold stop at the next call. revoke_agent_credential revokes a single credential without the kill-switch registry record.
- Each revocation is a signed record on the public ledger with its time and reason, so you can show when access was cut off.
Rightshold can only refuse what your code asks Rightshold about. It can't revoke your Google, GitHub, Slack or Microsoft tokens, delete SSH keys or stop a process; revoke those at each provider.
What are the sources?
- Google: Using OAuth 2.0 for web server applications (token revocation)
- RFC 7009: OAuth 2.0 Token Revocation
- GitHub REST API: OAuth authorizations (delete an app authorization or token)
- GitHub REST API: GitHub Apps (suspend or delete an installation)
- GitHub: Generating an installation access token (expires after 1 hour)
- GitHub: Reviewing and revoking personal access tokens in your organization
- Slack: auth.revoke method
- Microsoft Graph: user revokeSignInSessions
- Microsoft identity platform: Access tokens (token lifetime)
Related
- How to build a kill switch for an autonomous AI agent
- How to give an AI agent a scoped, expiring credential instead of a long-lived API key
- How to scope OAuth tokens per task for AI agents
- How to rotate API keys and tokens after a malicious VS Code or Cursor extension
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'