---
schema_version: "1"
id: b0acf1975274f0bbbb2619dd00c37b622824e2df35fd2152aba4bfc62cea708e
title: Revoke All JSON Web Token (JWT)-Based Access Tokens
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/connected_app_revoke_jwt.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.connected_app_revoke_jwt.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: bf357158c87f9740535e08768ab41094b2e1867f50d9c5cca9e951682b150173
description: If necessary, you can revoke all JSON Web Token (JWT)-based access tokens issued by all external client apps and connected apps. Revoking JWT-based access tokens invalidates their signing keys, which makes the tokens unusable.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Revoke All JSON Web Token (JWT)-Based Access Tokens

If necessary, you can revoke all JSON Web Token (JWT)-based access tokens issued by all external client apps and connected apps. Revoking JWT-based access tokens invalidates their signing keys, which makes the tokens unusable.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition">
        <colgroup>
          <col>
        </colgroup>
        <tbody>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and
              Lightning Experience</td>
          </tr>
          <tr class="">
            <td class="slds-cell-wrap" style="vertical-align:top;">
              <p>Connected Apps can be created in: <strong>Group</strong>, <strong>Essentials</strong>,
                <strong>Professional</strong>, <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and
                <strong>Developer</strong> Editions
              </p>
              <p style="margin-bottom:0;">Connected Apps can be installed in: All editions</p>
            </td>
          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note Connected apps creation is restricted as of Spring ‘26. You can continue to use existing connected apps during and after Spring ‘26. However, we recommend using [external client apps](https://help.salesforce.com/s/articleView?id=xcloud.external_client_apps.htm&language=en_US) instead. If you must continue creating connected apps, contact Salesforce Support.

See [New connected apps can no longer be created in Spring ‘26](https://help.salesforce.com/s/articleView?id=005228017&type=1&language=en_US) for more details.

After you revoke all JWT-based access tokens, it can take up to 30 minutes for the token revocation to propagate to all systems. The token revocation process doesn't delete associated sessions. Clients that have direct access to associated sessions, such as clients that use hybrid OAuth flows, continue to retain access even when their tokens are revoked.

To revoke JWT-based access tokens for an individual user, see [Revoke OAuth Tokens Programmatically](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_revoke_token.htm&language=en_US).

Revoking all JWT-based access tokens doesn’t automatically revoke all refresh tokens. To revoke refresh tokens for an external client app, see [External Client App OAuth Usage](https://help.salesforce.com/s/articleView?id=sf.external_client_app_oauth_usage.htm&language=en_US). To revoke all refresh tokens issued by a connected app, see [Manage Current OAuth Connected App Sessions](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_current_sessions.htm&language=en_US). Revoke refresh tokens for all apps that can issue JWT-based access tokens.

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_tip.png)

Tip To get help from an AI agent on this task, use Setup with Agentforce. For more information, see [Identity Management in Setup with Agentforce](https://help.salesforce.com/s/articleView?id=xcloud.setup_agentforce_identity.htm&language=en_US).

1. From Setup, in the Quick Find box, enter OAuth, and then select **OAuth and OpenID Connect Settings**.
2. Click **Revoke Tokens**.
3. If you accept the warning, click **Revoke** again.