--- title: A Stolen Token Is Useless. A Stale One Still Works. description: A detailed response to Michał Piszczek's essay 'Token Revocation Is Not an Endpoint' argues that sender-constraining tokens (like DPoP) only prevents theft,... canonical: https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A Stolen Token Is Useless. A Stale One Still Works. | daily.dev og:description: A detailed response to Michał Piszczek's essay 'Token Revocation Is Not an Endpoint' argues that sender-constraining tokens (like DPoP) only prevents theft,... og:url: https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq og:image: https://api.daily.dev/og/posts/1McdF6WhQ.png og:image:alt: A Stolen Token Is Useless. A Stale One Still Works. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Stolen Token Is Useless. A Stale One Still Works. **[API Evangelist](https://daily.dev/sources/apievangelist)** · 11 min read · 1 upvotes · 0 comments ## Summary A detailed response to Michał Piszczek's essay 'Token Revocation Is Not an Endpoint' argues that sender-constraining tokens (like DPoP) only prevents theft, but does nothing about 'stale authority' — a cryptographically valid token that is operationally unauthorized. The piece breaks revocation into four planes (decision, distribution, enforcement, effects) and introduces a metric, Revocation Completion Time (RCT), plus a formula for Revocation Exposure that multiplies RCT by action rate and impact — showing why short-lived tokens don't bound risk for high-throughput AI agents. It then evaluates Germany's federated API authorization blueprint against this four-plane framework, finding strong decision/distribution/enforcement planes but a largely unaddressed effects plane for delegated credentials and in-flight work. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why doesn't revoking an OAuth access token immediately stop it from being used? Revocation is not a cryptographic operation because a signed token's bytes remain valid until expiry; revoking it means introducing fresher state at the enforcement point than the token carries. RFC 7009 explicitly allows a propagation delay, and returns the same success response whether a token existed or not, so a 200 from a revoke endpoint is an intention, not proof anything actually stopped. _Anyone hardening an auth flow can track deeper explainers like this one on daily.dev before shipping a revocation feature._ ### Why is a short-lived access token not actually safe for AI agents making frequent API calls? A short expiry only bounds risk when the action rate during that window is also bounded. At one hundred accepted actions per second, a fifteen-minute token allows roughly ninety thousand actions before it expires, so the same TTL that feels safe for a human session performing a few clicks becomes dangerous once an agent is making hundreds of calls and spawning subagents in that window. _Developers building agent authorization should weigh action-rate math like this alongside daily.dev updates on API security._ ### What are the four planes needed to measure whether token revocation actually works? They are the decision plane (recording that a token or session is no longer trusted), the distribution plane (propagating that decision via event streams or cache invalidation), the enforcement plane (gateways and services denying the next request), and the effects plane (stopping or containing work already admitted, like queued jobs or open connections). Succeeding at the decision plane alone does not stop an attack in progress. _Teams designing zero trust architectures can follow frameworks like this via daily.dev to close revocation gaps._ ## Similar posts on daily.dev - [Never Trust the Token: DPoP and Sender-Constraining for Government APIs](https://daily.dev/posts/never-trust-the-token-dpop-and-sender-constraining-for-government-apis-vjxctjijv) · API Evangelist · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A Stolen Token Is Useless. A Stale One Still Works.","url":"https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq"},"datePublished":"2026-08-20T11:55:01.004Z","dateModified":"2026-09-13T21:23:32.816Z","description":"A detailed response to Michał Piszczek's essay 'Token Revocation Is Not an Endpoint' argues that sender-constraining tokens (like DPoP) only prevents theft,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c3b86c372435147ad13422a472e4f8f0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c3b86c372435147ad13422a472e4f8f0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"API Evangelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"API Evangelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a36244ae67bc4f41a605f780267ecb5f","url":"https://daily.dev/sources/apievangelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,oauth","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"API Evangelist","item":"https://daily.dev/sources/apievangelist"},{"@type":"ListItem","position":3,"name":"A Stolen Token Is Useless. A Stale One Still Works."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-stolen-token-is-useless-a-stale-one-still-works--1mcdf6whq#faq","mainEntity":[{"@type":"Question","name":"Why doesn't revoking an OAuth access token immediately stop it from being used?","acceptedAnswer":{"@type":"Answer","text":"Revocation is not a cryptographic operation because a signed token's bytes remain valid until expiry; revoking it means introducing fresher state at the enforcement point than the token carries. RFC 7009 explicitly allows a propagation delay, and returns the same success response whether a token existed or not, so a 200 from a revoke endpoint is an intention, not proof anything actually stopped. Anyone hardening an auth flow can track deeper explainers like this one on daily.dev before shipping a revocation feature."}},{"@type":"Question","name":"Why is a short-lived access token not actually safe for AI agents making frequent API calls?","acceptedAnswer":{"@type":"Answer","text":"A short expiry only bounds risk when the action rate during that window is also bounded. At one hundred accepted actions per second, a fifteen-minute token allows roughly ninety thousand actions before it expires, so the same TTL that feels safe for a human session performing a few clicks becomes dangerous once an agent is making hundreds of calls and spawning subagents in that window. Developers building agent authorization should weigh action-rate math like this alongside daily.dev updates on API security."}},{"@type":"Question","name":"What are the four planes needed to measure whether token revocation actually works?","acceptedAnswer":{"@type":"Answer","text":"They are the decision plane (recording that a token or session is no longer trusted), the distribution plane (propagating that decision via event streams or cache invalidation), the enforcement plane (gateways and services denying the next request), and the effects plane (stopping or containing work already admitted, like queued jobs or open connections). Succeeding at the decision plane alone does not stop an attack in progress. Teams designing zero trust architectures can follow frameworks like this via daily.dev to close revocation gaps."}}]} ```