> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Token lifecycle states

> The states an e6data access token moves through - active, expired, and revoked - and how each is enforced.

An access token (PAT or service account key) moves through a small set of states.

| State | Meaning | Authenticates? |
| - | - | - |
| **Active** | Created and within its expiry | Yes |
| **Expired** | Past its expiry timestamp | No - returns `401` |
| **Revoked** | Explicitly deleted | No - rejected immediately |

* A token is **created** with its secret shown once; from then it is **active**.
* Expiry is enforced on **every** request. An expired token returns `401 Unauthorized` and **cannot be extended** - create a replacement and revoke the old one.
* Revocation takes effect **immediately** - a revoked token fails on its next request.

Note that a valid token whose owner lacks the required permission still returns `403 Forbidden` - that's an authorization result, not a token state. Removing a user's workspace access does **not** revoke their tokens; revoke them explicitly. See [Token security best practices](/platform/tokens/best-practices).

## See also

* [Token expiry rules](/platform/reference/tokens/expiry-rules)
* [Create, use, rotate, and revoke tokens](/platform/tokens/create-rotate-revoke)
* [Access tokens](/platform/tokens/pat-and-service-account-keys)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.