Unauthorized: invalid token error when using expired FaunaDB login token

Issue

When a FaunaDB login‑based token is presented after its TTL expires, the server responds with Unauthorized: invalid token. This behavior is documented for login tokens and is the primary indicator of credential expiration.

Least‑Privilege Context

FaunaDB supports scoped keys with specific roles (Server, Admin, Client, Custom) and ABAC predicates to restrict access. Tokens derived from these keys inherit the key's permissions but are governed by their own TTL. Deleting a key does not immediately revoke tokens that were issued from it; they remain valid until their TTL lapses.

Unresolved Decision

The current design leaves open whether a key deletion should automatically invalidate all active tokens derived from that key. This has implications for security post‑credential compromise and for operational practices around key lifecycle management.

Questions

• Should deleting a FaunaDB key automatically revoke all login tokens derived from it, or should revocation remain TTL‑based?
• What TTL strategy best balances least‑privilege access with the security risk posed by long‑lived tokens?
• Is there a supported API or mechanism to force‑invalidate active tokens beyond their configured TTL?