[robertlagrant]

> If you rotate every week you can have a job that runs every week, offset by one day, to revoke.

This might be a silly question, but how do you authenticate that revoke?

[insanitybit]

Usually tokens have the right to revoke themselves or you have a separate system like Vault that manages revocation.