Access token is active even after revoking

[skulkarni]

We have proxy which gets access and refresh token from external service.

When we revoke the tokens using invalidatetoken operation and try to verify the same access token with validatetoken operation , its still active.

[dchiesa1]

Yes,

the tokens are cached in the MP.

You must wait until the cache expires. Currently the TTL on cached tokens is 180s I think.

That would be 180 seconds from... the time the cache was populated with the token. This is not the same as the "last time token was seen" or "first time token was seen".

AFAIK there is no way to forcibly invalidate the cache for a specific token.