token:revoke

Revokes active authentication tokens, optionally restricted by user, group, or issue date. Run without any filter options, it targets every currently active token.

Filters (combine as needed; a token must match all given filters to be revoked):

  • -u, --user= - only tokens owned by a given user, identified by UUID (takes precedence) or the configured unique identifier.
  • -g, --group= - only tokens owned by users belonging to a given group, identified by UUID.
  • -b, --issued-before= / -a, --issued-after= - only tokens issued before/after a given point in time, formatted YYYY-MM-DD HH:MM in UTC. Combining both requires --issued-after to be earlier than --issued-before, otherwise the command errors out.
  • --issued-with-expiration-date / --issued-without-expiration-date - only tokens that do (or don’t) have an explicit expiration date. These two are mutually exclusive.

Other options:

  • -f, --force - skips the interactive confirmation prompt before revoking.
  • --dry-run - lists every token that would be affected, without revoking anything and without prompting.
  • -l, --list-all-affected-tokens - shows the full list of affected tokens in the confirmation table. Without it, the table is capped at the first 10 tokens once more than 10 would match (the full set is still revoked, only the preview is capped).

If no tokens match, the command exits successfully without asking for confirmation. Revoking marks each matching token as revoked in the graph database and expires its corresponding Redis session key.

Help

php bin/console token:revoke --help
Description:
  Revoke tokens.

Usage:
  token:revoke [options]

Options:
  -f, --force|--no-force                                        If enabled, command will not ask for manual confirmation.
      --dry-run|--no-dry-run                                    Does not apply revocation. Also lists all tokens which would be affected.
  -l, --list-all-affected-tokens|--no-list-all-affected-tokens  Lists all tokens.
  -u, --user=USER                                               Token revocation is only applied to an given user. User can be specified by its UUID (takes precedent) or its identifier.
  -g, --group=GROUP                                             Token revocation is only applied to users of given group. Group must be specified by its UUID.
  -b, --issued-before=ISSUED-BEFORE                             Token revocation is only applied to tokens issued before a given point in time. Datetime must be in the format "YYYY-MM-DD HH:MM" (UTC).
  -a, --issued-after=ISSUED-AFTER                               Token revocation is only applied to tokens issued after a given point in time. Datetime must be in the format "YYYY-MM-DD HH:MM" (UTC).
      --issued-without-expiration-date                          Token revocation is only applied to tokens with no explicit expiration date.
      --issued-with-expiration-date                             Token revocation is only applied to tokens with explicit expiration date set.
  -h, --help                                                    Display help for the given command. When no command is given display help for the list command
      --silent                                                  Do not output any message
  -q, --quiet                                                   Only errors are displayed. All other output is suppressed
  -V, --version                                                 Display this application version
      --ansi|--no-ansi                                          Force (or disable --no-ansi) ANSI output
  -n, --no-interaction                                          Do not ask any interactive question
  -e, --env=ENV                                                 The Environment name. [default: "prod"]
      --no-debug                                                Switch off debug mode.
      --profile                                                 Enables profiling (requires debug).
  -v|vv|vvv, --verbose                                          Increase the verbosity of messages: 1 for normal output, 2 for more verbose output and 3 for debug

Example

php bin/console token:revoke -f
    ▄
  ▄▀ ▀▄  Ember Nexus API
   ▀█▀   v0.1.31, production mode

  Token Revocation

  51 tokens are affected by revocation. First 10 are shown:

  Token UUID                            User UUID                             User identifier                                     Created              Expires on 
  571b30e2-40eb-43f5-a888-a6b7ec6c15fc  fdf0509d-812c-4435-a863-a4fd6f17e9c4  user@relation.postIndex.endpoint.localhost.dev      2026-04-14 21:01:58  -
  6009d74a-1db9-4d1a-bc16-a948706dca58  2274873a-b9a2-4e77-b330-900857b76c1d  user@node.postIndex.endpoint.localhost.dev          2026-04-14 21:01:58  -
  84e32a4f-840b-435a-a064-2e72f19d8b20  53ae199c-6b71-44c1-b10c-fca306b32cbf  user@relation.putElement.endpoint.localhost.dev     2026-04-14 21:01:58  -
  ca9fa4fe-1fbd-4e8a-a6bf-701d97a7ec12  7935a9d2-e453-4dec-bc4a-243e3ced678a  user@node.putElement.endpoint.localhost.dev         2026-04-14 21:01:58  -
  840fee16-996e-4b1a-af2a-77d77c4aeda7  a70e49dc-ec45-414a-beb2-43e6fa56eb41  user@relation.deleteElement.endpoint.localhost.dev  2026-04-14 21:01:58  -
  374fa7ea-4df7-475c-a6a6-b35ff7b9bae1  1a0fd886-9f62-497f-8d20-bd61a40b49b7  user@node.deleteElement.endpoint.localhost.dev      2026-04-14 21:01:58  -
  9543e70d-6552-4409-ab6a-dfaf003382a2  8d70608f-ebca-4077-98d2-12733b7fd08e  user@relation.patchElement.endpoint.localhost.dev   2026-04-14 21:01:58  -
  5f450171-c535-4365-ac70-a283955d4ff5  4250a83d-707b-4f7a-b7dc-225af430f093  user@node.patchElement.endpoint.localhost.dev       2026-04-14 21:01:58  -
  befd839e-5711-414e-8fe3-a8a3225dd603  1eb25cca-9c9e-4ec9-a9be-9044741b2b8c  user@deleteToken.user.endpoint.localhost.dev        2026-04-14 21:01:58  -
  ed1891bf-d7a8-4e64-ba0d-ebec82ad173e  1eb25cca-9c9e-4ec9-a9be-9044741b2b8c  user@deleteToken.user.endpoint.localhost.dev        2026-04-14 21:01:58  -

  Revoking tokens...

▶ Successfully revoked tokens.