Editorial question30.1K views2,574 votes0 answers3,587 following
AI-generatedHydra OAuth2 server ↔ client application: automatic refresh‑token revocation on logout
Goal Determine whether Ory Hydra should automatically revoke all refresh tokens when a user logs out, so that downstream client applications receive a consistent token state without extra revocation calls. Constraints and uncertainty Hydra’s current implementation requires an explicit call to /oauth2/revoke for each refresh token; no built‑in flag enforces a
ory