Available

Revoke an agent

Revoke an AI agent in one action, see what stops working and where, and have your own services told the moment it happens.

Revoking an AI agent ends its ability to sign in and keeps its history. Use it when an agent's key may be exposed, or when the agent is no longer needed. This guide also shows you how to have your own services told when an agent is revoked.

Before you begin

You need:

Administrator access to the AuthFI console.
To receive revocation events: an https endpoint on your server.

Revocation cannot be undone

A revoked agent stays revoked. If you need the agent again, register a new one.

Revoke the agent

In the console, open Identity > AI Agents and select the Agents tab.
Open the agent.
Open "More actions" and choose one of the two revoke actions.
Confirm in the bar that appears.

Action	Use it when	The console then shows
Revoke credential	The agent must stop	"Credential revoked"
Revoke as compromised	You believe the agent's key was stolen	"Revoked as compromised"

Both actions stop the agent from authenticating at once. Revoke as compromised also tells every subscribed service that the credential is believed stolen, so that they can look at what the agent did.

What the agent was allowed to do stays on record. Its tools, its delegations and its permissions are untouched.

Check that it works

In the console, the Agents tab lists the agent with the status "Revoked".

Then sign in as the agent, as in Give an AI agent an identity. The token endpoint rejects the request:

{ "error": "invalid_client" }

What revocation stops

Where	What happens
Sign-in	A request for a new token gets `invalid_client`
The MCP gateway	The agent's next call is denied, even with an unexpired token
Approvals and authorize	Denied
Nodes running Zero-Code	Read the revoked list, and reject the agent's remaining tokens
Any other service	Sees the token as inactive if it asks AuthFI

A service that checks only the signature accepts the agent's access token until it expires, at most 15 minutes later. To stop sooner, receive revocation events in that service.

Revoke or delete

Deleting an agent is a different action. It permanently removes the agent and its record of what it was allowed to do. Revoke first, and delete only when you no longer need that record. Deleting is for an agent that was registered by mistake.

On the agent's page, open "More actions" and choose Delete agent….
In the dialog "Delete this agent?", type the agent's name in the confirmation field.
Choose Delete permanently.

The agent first gives back the tools, delegations and permissions it holds. The console then shows "Deleted" with the agent's name.

Receive revocation events

If your own services accept agent access tokens, AuthFI can tell them the moment an agent is revoked. It pushes a signed event to your server, using OpenID Shared Signals. A service that subscribes this way is also told when you choose Revoke as compromised.

Read the Shared Signals configuration

The project publishes where to register a receiver and which events exist.

curl https://acme.authfi.io/.well-known/ssf-configuration

{
  "issuer": "https://acme.authfi.io",
  "jwks_uri": "https://acme.authfi.io/.well-known/jwks.json",
  "configuration_endpoint": "https://acme.authfi.io/v1/ssf/streams",
  "delivery_methods_supported": ["urn:ietf:rfc:8935"],
  "events_supported": [
    "https://schemas.openid.net/secevent/caep/event-type/session-revoked",
    "https://schemas.openid.net/secevent/caep/event-type/token-claims-change",
    "https://schemas.openid.net/secevent/risc/event-type/account-purged",
    "https://schemas.openid.net/secevent/risc/event-type/credential-compromise"
  ],
  "spec_version": "1_0"
}

Register a receiver

An administrator registers the URL that events are sent to.

POST

/v1/ssf/streams

Field	Meaning
`audience`	A value you choose. It is the `aud` of every event sent to you.
`endpoint_url`	Where to send events. It must be `https`.
`auth_token`	Optional. Sent back to you as a Bearer credential, so you can tell the sender is AuthFI.
`events_requested`	Optional. The event types you want.

Verify each event

Events are delivered by HTTP POST (RFC 8935). Each one is a signed token. Before you act on an event:

Verify the signature against the project's keys, at the jwks_uri above.
Check that iss is your project's issuer, https://acme.authfi.io.
Check that aud is the audience you registered.

Then stop accepting that agent's tokens.

Troubleshooting

After you revoke an agent, the agent and the services it calls see these responses.

What you see	Cause	Fix
`invalid_client` when the agent signs in	The agent is revoked	Register a new agent if you need one
`invalid_token` from a service behind Zero-Code	The agent is revoked	Register a new agent if you need one

Next steps

Accept agents at your own API

Verify agent access tokens in the service that receives the events.

The audit record

Read what the agent did before it was revoked.

Discovery documents

The Shared Signals configuration, with the project's other documents.

Protect an API

Have Zero-Code check revocation on every request to your service.