{"version":"2.1.216","anchor":"mcp-oauth-revoke-replaced-tokens-at-logout","canonical_anchor":"mcp-oauth-revoke-replaced-tokens-at-logout","heading":"MCP OAuth: Revoke Replaced Tokens at Logout","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216\/e\/mcp-oauth-revoke-replaced-tokens-at-logout","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216","markdown":"### MCP OAuth: Revoke Replaced Tokens at Logout\n\n**What**\n\nWhen an MCP server's OAuth tokens are replaced (e.g., during re-authentication or token refresh), the old access and refresh tokens are now explicitly revoked at the server's `revocation_endpoint` before they are discarded.\n\n**Details**\n\n- Discovers the revocation endpoint from OAuth server metadata\n- Supports both `client_secret_basic` and `client_secret_post` authentication methods\n- Revokes refresh token first, then access token\n- Logs failures with `Failed to revoke refresh token:` \/ `Failed to revoke access token:` but does not block the replacement\n\n**Evidence**\n\nToken revocation (search for `\"Failed to revoke replaced tokens:\"` or `\"No replaced tokens to revoke\"`)."}