Token Lifecycle Management for Inference Engines

Security Requirement

Inference engines and their supporting infrastructure MUST implement proper token lifecycle management including refresh token rotation, replay prevention, and instant revocation capabilities.

Refresh Token Rotation

Require IdP refresh token rotation with one of:

• DPoP (Demonstrating Proof-of-Possession): Sender-constrained tokens that bind the token to the client's key pair, preventing token theft and replay.
• PAR (Pushed Authorization Requests): Authorization request parameters are sent directly to the IdP, reducing exposure of sensitive parameters.

Revocation

Implement a two-layer revocation strategy:

1. IdP Revocation Endpoint: Use the IdP's /oauth/revoke endpoint as the primary revocation mechanism.
2. Local Blacklist: Maintain a Redis-based or in-memory JWT blacklist keyed by jti for instant propagation without IdP round-trips.