Authentication tokens are being abused. What do I do?

Short explanation:

Abused credentials create an active access-control incident, not just a validation bug. The response must stop unauthorized use, establish how credentials were obtained and restore the affected authentication boundary. The right revocation action depends on whether a single session, many refresh tokens or signing credentials were compromised.

Key points:

• Identify affected accounts/sessions and stop further unauthorized access.

• Revoke affected sessions or refresh tokens; use available access-token revocation controls.

• Investigate the leak and fix storage/logging/access checks; rotate signing keys if those keys were compromised.

• Preserve relevant audit evidence without copying raw tokens into ordinary logs.

• Verify that the corrected flow blocks the observed misuse and check for related resource-level authorization gaps.

Interview point:

• Avoid rotating every signing key without evidence; scope containment to the compromise while respecting the system's revocation limits.