Revoke
To invalidate a credential or permission so it can no longer authenticate or authorize the actions it previously allowed.
What it is
Revoking access is the immediate containment action for a lost, exposed, expired, or no-longer-needed credential. It tells the issuing service to reject the value, but it does not erase copies from logs, tickets, local files, or Git history; those copies still need cleanup and the replacement credential must be handled safely.
How it relates to Orbit
Orbit tracks whether an exposed credential has been revoked with its provider after a Security finding. See /docs/concepts/security/ for details.
When you would use it
You revoke first when a credential may be in an unauthorized person's hands, then investigate the exposure and rotate the access that still needs to exist.
Common operations
- Revoking an API key or personal access token after a repository leak or device loss.
- Removing stale access before rotating the replacement credential and reviewing remaining permissions.