Platform Token Management
What this screen is for
A tenant's token screen lists the revoked-token blacklist entries that belong to that tenant. This screen, opened by the Token Management entry of the platform sidebar, is the same blacklist seen whole: Global Token Blacklist, every entry of every tenant of the installation, including your own platform tenant — so the revoked sessions of platform operators appear here alongside the tenants' own.
Everything the tenant page says about what an entry is holds here, and this page does not repeat it: a row is a token that is already revoked, identified only by its JTI; expired tokens, refresh tokens and sessions ended by a role change or a removal do not appear; and the one action acts on an entry already in the list. Whatever language the console is set to, this screen's labels are in English.
What must exist first
This screen exists on a customer-operated install only. On an ANKA-hosted deployment it is not offered: the sidebar has no entry for it, and its address sends you back to the platform overview. Before you work here:
- The platform permission to read tokens, which shows the sidebar entry, the list and a person's sessions. The built-in platform administrator, operator, auditor and viewer roles hold it. Without it the screen says you do not have permission to view platform token management.
- The platform permission to revoke tokens, held by the built-in platform administrator role, which adds the Action column and lets you end a person's sessions.
Decisions you make here
Reading the list, and narrowing it to one tenant
What the platform plane adds to the tenant view is reach and a filter. Filter by Tenant ID (optional) takes a tenant's identifier and lists that tenant's entries alone; Clear returns to the whole installation. The filter matches the identifier exactly, so a mistyped one lists nothing and the screen reads No revoked tokens found for tenant …. The list is capped at 5,000 entries and says Showing first 5,000 entries. when the cap is reached; Total revoked counts what was returned, filtered or not.
Nothing else is shown per row: not the tenant an entry belongs to, not whose token it was, not when it was revoked. To know which tenant an entry belongs to, filter by that tenant.
Revoking an entry
With the revoke permission, the trash icon of a row opens Force Revoke Token, which says it will immediately invalidate the token for any user across all tenants. Read that against the heading: the token is already refused everywhere, and the request repeats a revocation that already stands, rewriting the entry to be remembered for 30 days. It cannot be undone, and there is nothing further it could stop. The revocation, like every read of this list, is written to the authentication audit trail.
The request is refused, and the screen reports that the token could not be revoked, when the platform no longer knows which tenant the token belonged to — which happens once the token has passed its own expiry.
Ending a person's sessions
In Sign-in sessions, enter the person's Identity ID (the User ID shown in their user detail) and select Show sessions to list their open sessions in every tenant: the tenant each one is in, when it began, how the person signed in, its last activity and when it ends at the latest.
With the revoke permission, End session ends one session, and End every session of this person ends all of them, everywhere; they can sign in again afterwards. Each action is written to the authentication audit trail, naming you and the person.
To end other access that is still valid, go where the identity lives: a platform operator's sessions end when their role is taken away or their password reset is forced on the platform users screen; a tenant's people and actors are administered from inside the tenant; and suspending a tenant refuses its sign-ins and its cryptographic operations, while closing it revokes its access outright.
How it relates to other screens
The revoked list records the aftermath of revocations decided elsewhere. A tenant administrator sees the same entries, restricted to their tenant, on their own token screen, and ends a member's sessions there only within their tenant. A session you open inside a tenant from the tenants screen is not ended by leaving it: its token is dropped and lapses within 15 minutes, and it appears here only if it was revoked.