Four different states
- Bhauu session: the user's authentication at Bhauu Auth.
- Client authorization: consent and the connected-app relationship.
- OAuth tokens: time-limited credentials for a registered client.
- Application session: the client's own local login state and cookie.
What revocation can and cannot do
Revoking an app's authorization does not delete the Bhauu Identity or the application's data. Existing short-lived access tokens may remain usable until expiry unless the client checks current status. The application must revalidate, process supported revocation events, or apply a bounded local-session lifetime to stop its own session.
Session recovery
Recovery and refresh behavior depend on client registration and architecture. Do not assume one recovery method applies to every application. Build a local session policy and handle an inactive Bhauu session or failed renewal as a signal to end or reauthenticate the local session.