Function: integratorRevocationCheck()

function integratorRevocationCheck(opts?: IntegratorRevocationOptions): RevocationCheck | null;

Defined in: revocation.ts:344 (opens in a new tab)

For an integrator's server: refuse a session the person ended everywhere (sign out everywhere, a passkey removed, the account deleted). A token from the sign-in popup carries rh, its revocation handle for its own audience; this looks it up in me.ochk.io's list of ended handles for that audience (/api/integrator/revocations), fetched at most once a minute per audience with a request signed by the project secret over method, path and audience. A token without rh is checked by its signature alone. Staleness is measured from the list's own at. Null when the project key or secret is not set: a site that has not configured it keeps verifying by signature alone rather than refusing writes.

Call it with a session verifyOcToken has already accepted: the audience it looks up is the token's own aud, sent exactly as minted.

Parameters#Link to this section

Returns#Link to this section

RevocationCheck | null