WooCommerce REST API Key Scope Persistence After Intended Expiry

WooCommerce REST API authentication relies on API keys or OAuth 1.0a tokens, each assignable specific permission scopes at generation. A precise design goal is to determine whether keys created with read-only scopes persist indefinitely or are subject to native expiration enforcement despite intended credential lifetime policies.

Core WooCommerce provides no built-in time-based credential expiration; API keys remain valid until manually revoked through the WordPress admin, and OAuth tokens require explicit revocation without guaranteed scope preservation. This creates a constraint where least-privilege configurations can be undermined by credential longevity beyond intended operational windows.

Uncertainty remains around how revocation mechanics interact with originally assigned permission scopes, and whether any documented workflow enforces credential lifetime without third-party extensions that introduce additional attack surface.

• Does the REST API revocation endpoint invalidate access while preserving or clearing the key's original scope?
• Can API key metadata be updated to include an expiration timestamp that core WooCommerce recognizes and enforces?
• What is the security impact of retaining read-only keys indefinitely after intended rotation periods in production environments?