Vault token auth adds OAuth JWT revocation routes and a global denylist
Introduced 2026-10-15 · score 0.91
HOW TO USE IT
When revoking an OAuth JWT, POST its issuer, configured unique ID claim, and denylist duration to `/auth/token/revoke-oauth`. For a Vault token, POST its accessor to `/auth/token/revoke-accessor`.
curl --header "X-Vault-Token: <vault-token>" --request POST --data '{"issuer":"<jwt-iss>","unique_id":"<configured-unique-id>","exp":3600}' http://127.0.0.1:8200/v1/auth/token/revoke-oauthcurl --header "X-Vault-Token: <vault-token>" --request POST --data '{"accessor":"<token-accessor>"}' http://127.0.0.1:8200/v1/auth/token/revoke-accessorWHY THIS HELPS
Revoke an OAuth JWT so it cannot be authorized across Vault namespaces.
REQUIREMENTS AND LIMITATIONS
- Version: v2.2.0
- revoke-oauth.issuer (required): JWT `iss` claim identifying the OAuth issuer.
- revoke-oauth.unique_id (required): JWT claim value configured as `unique_id_claim` on the OAuth resource server profile.
- revoke-oauth.exp (required): Seconds to keep the JWT on Vault's denylist when the full JWT is not stored; actual JWT `exp` overrides this after the token is discovered.
- revoke-accessor.accessor (required): Accessor of the token to revoke.
- Prerequisite: The `revoke-oauth` endpoint is Enterprise.
- Prerequisite: Requests use a Vault token in the `X-Vault-Token` header or `Authorization: Bearer <token>` header.
- The global denylist applies across all namespaces.
- The `revoke-oauth` endpoint identifies an external token by issuer and unique ID.
FIRST-PARTY EVIDENCE
- https://github.com/hashicorp/vault/releases/tag/v2.2.0
- https://developer.hashicorp.com/vault/api-docs/auth/token
- https://developer.hashicorp.com/vault/docs/auth/token
Check the installed version and the source before using it. Entry JSON