Token lifecycle states

The states an e6data access token moves through - active, expired, and revoked - and how each is enforced.

An access token (PAT or service account key) moves through a small set of states.

State	Meaning	Authenticates?
Active	Created and within its expiry	Yes
Expired	Past its expiry timestamp	No - returns 401
Revoked	Explicitly deleted	No - rejected immediately

• A token is created with its secret shown once; from then it is active.
• Expiry is enforced on every request. An expired token returns 401 Unauthorized and cannot be extended - create a replacement and revoke the old one.
• Revocation takes effect immediately - a revoked token fails on its next request.

Note that a valid token whose owner lacks the required permission still returns 403 Forbidden - that's an authorization result, not a token state. Removing a user's workspace access does not revoke their tokens; revoke them explicitly. See Token security best practices.

See also

• Token expiry rules
• Create, use, rotate, and revoke tokens
• Access tokens