🔐
AB-131
Token revocation endpoint available
What it means
Your OAuth metadata publishes a revocation_endpoint.
Why it matters
Revocation lets agents and vaults invalidate compromised tokens immediately. Without revocation, a leaked token remains valid until expiry.
✗
What's wrong
OAuth metadata has no revocation_endpoint.
✓
What's right
OAuth metadata: { revocation_endpoint: 'https://api.example.com/oauth/revoke' }
Check this rule on your site
Enter your URL to check just this one rule (AB-001).