token-status-list-core

A token status list is a compressed byte array structure that communicates token validity changes for JWT and CWT formats, allowing relying parties to verify revocation status without directly querying the issuer for each token.

You can manage token revocation at scale by using a token status list, which provides a single efficient endpoint where issuers update statuses and relying parties check token validity, avoiding direct issuer contact for every verification request.

The token status list encodes revocation data as compressed byte arrays, supporting both JSON encoding for JWT integration and CBOR encoding for CWT integration to ensure secure and efficient status transmission.

Issuers update the token status list when token validity changes, holders present tokens containing status list references, and relying parties fetch and check the compressed status list to verify token validity without contacting the issuer directly.

The token status list approach addresses privacy concerns by allowing relying parties to check token validity through a shared compressed list endpoint, preventing issuers from tracking which tokens are being verified and by whom.

You need a token status list when managing invalidation or suspension for thousands of issued access tokens or verifiable credentials, requiring an interoperable and scalable mechanism to communicate validity changes to relying parties.