Sessions & tokens

Inspect and revoke in-flight OIDC state, codes, access tokens, and admin sessions.

Security overview

Pending OIDC — browser sent to JumpCloud, callback not completed. Authorization code — trampoline code not yet exchanged at /oauth2/token. Access token — full access and ID JWTs are stored in DynamoDB for this row (admin-only). Payloads are shown decoded (parse-only, not re-verified in the UI). Revoke marks the access token in DynamoDB — relying parties must validate revocation themselves until exp. Admin session — HttpOnly cookie bound to a DynamoDB row (sub/email/scope, TTL); revoke deletes the row so that browser can no longer call the admin API.