IBM Cloud IAM API key expiration and active token validity

IBM Cloud IAM supports expiration for Service ID API keys and Trusted Profile credentials as part of least-privilege authentication designs. The documented behavior for key expiration is that new token requests using the expired credential are rejected.

The unresolved behavior concerns IAM access tokens that were issued before the credential expired. Access tokens are bearer tokens with their own lifetime, and it is unclear whether key expiration also terminates tokens already in use or only prevents future issuance.

For a least-privilege rotation strategy, the residual token lifetime window determines exposure after expiration. Clarification is needed on the intended security boundary.

Does expiring a Service ID API key or Trusted Profile credential invalidate existing IAM access tokens immediately, or do those tokens remain valid until their natural expiry? Is token revocation tied to key expiration by default in IBM Cloud IAM, or is a separate revocation action required?