Concept
How do you revoke an AI agent's credentials?
An agent credential can be revoked only where a checked page states the path. IBM Agent Identity, read 2026-10-28, says a session can be revoked in real time and that dynamically generated credentials expire or can be revoked. ServiceNow AI Passport, read 2026-10-21, says passport revocation can propagate within approximately one second.
Last verified 2026-10-28
Sources
How to read this
This table includes a listing only when its gap note has a revocation claim. Documented means the cited page states a revoke path. Not documented means that page does not state one, and the cell uses the read date on that claim. Mixed means the note has both. How fast quotes the timing that page states. Rows are alphabetical. The table does not rank listings.
The source and checked date on a row apply to the what, documented, and how fast cells.
Wallet key is one revoke type this page looks for. None of the cited revocation claims names a wallet key.
A spend control claim on the IBM Agent Identity gap note, read 2026-10-28, says IBM Agent Identity uses OAuth-based, short-lived, task-scoped tokens. That claim does not describe revoking a token. The revocation row uses the revocation claims. IBM Agent Identity is now generally available: Building trust for the agentic era · Read 2026-10-28
| Listing | What can be revoked | Documented | How fast | Source | Checked |
|---|---|---|---|---|---|
| 1Password for Agents | Credential cache | Documented | The credential cache is destroyed when the session ends, when the browser closes, or after a hard cap of nine hours. The page also says you can deny a request. |
| 2026-10-28 |
| Beltic KYA | Not documented as of 2026-10-21 | Not documented as of 2026-10-21 | Not documented as of 2026-10-21 |
| 2026-10-21 |
| IBM Agent Identity | Session. Dynamically generated credential. Agent, by a kill switch in tech preview. | Documented | Real time for the session. The same release says dynamically generated credentials expire or can be revoked, and that a kill switch can shut down any agent, and it does not state a time for those. | 2026-10-28 | |
| Infisical open source Agent Vault | Agent token. Short-lived vault-scoped token. | Not documented as of 2026-10-28 | Not documented as of 2026-10-28 |
| 2026-10-28 |
| Kite Agent Passport | Session | Mixed | An approved session lasts until it expires or the budget runs out. A call that revokes an active session before it expires is not documented as of 2026-10-27. |
| 2026-10-27 |
| ServiceNow AI Passport | Passport. Kill switch capabilities. | Documented | The 2026-10-21 release says revocation enforcement can propagate across both layers within approximately one second. The 2026-10-15 release names precision revocation and kill switch capabilities and does not state a time. |
| 2026-10-21 |
| Socure Agent Intelligence | Agent Credential | Not documented as of 2026-10-28 | Not documented as of 2026-10-28 | 2026-10-28 | |
| Visa Trusted Agent Protocol | Not documented as of 2026-10-20 | Not documented as of 2026-10-20 | Not documented as of 2026-10-20 |
| 2026-10-20 |
Listings with no revocation row
These listings were in the set checked for this page. No row is shown because the directory has no sourced revocation claim. That is not a finding that the product has no revocation.
- ERC-8004 · Gap note
The gap note has no checked source for revocation.
- Microsoft Entra Agent ID
The directory has no gap note for this listing, and the listing record does not mention revocation.
- Web Bot Auth · Gap note
The gap note has no checked source for revocation.
Related reading
- Know Your Agent
- Agent identity
- Agent credentials compared
- Spend controls
- 1Password for Agents · Gap note
- Beltic KYA · Gap note
- IBM Agent Identity · Gap note
- Infisical open source Agent Vault · Gap note
- Kite Agent Passport · Gap note
- ServiceNow AI Passport · Gap note
- Socure Agent Intelligence · Gap note
- Visa Trusted Agent Protocol · Gap note
Related concepts
- Agent spend controls
Agent spending is bounded only where a vendor document states the bound.
- How is x402 volume measured
As of 2026-10-21, x402.org showed 75.41M transactions and $24.24M under Last 30 Days, and x402scan showed 3.06M transactions and $1.50M under Past 30 Days.
- Who handles a refund when an agent pays
A refund follows the page for that rail.
- x402 volume, claimed and measured
Public x402 volume figures disagree, and this page does not merge them.
Questions
- How do you revoke an AI agent's credentials?
- An agent credential can be revoked only where a checked page states the path. IBM Agent Identity, read 2026-10-28, says a session can be revoked in real time and that dynamically generated credentials expire or can be revoked. ServiceNow AI Passport, read 2026-10-21, says passport revocation can propagate within approximately one second.
- What does not documented mean on this page?
- Not documented means the cited page does not state that fact. The cell names the page and the day it was read. It is not a claim that the fact is false.
- Which listings document revocation?
- Documented: 1Password for Agents, IBM Agent Identity, and ServiceNow AI Passport. Mixed: Kite Agent Passport. Not documented: Beltic KYA, Infisical open source Agent Vault, Socure Agent Intelligence, and Visa Trusted Agent Protocol.
- Why are some identity listings missing from the table?
- ERC-8004 and Web Bot Auth have gap notes with no checked source for revocation. Microsoft Entra Agent ID has no gap note, and the listing record does not mention revocation. Omitted is not the same as not documented.
- Does this page rank a listing?
- No. Rows are alphabetical by listing name. A documented cell is not a recommendation.
- Where is the machine readable table?
- GET /data/agent-credential-revocation.json. The file lists the rows, the omitted listings, the sources, and the checked dates.
Sources
- 1Password support: security of 1Password for Claude
- Beltic site
- Beltic KYA TypeScript SDK
- Beltic press release, 2026-09-30
- IBM Introduces Identity and Control for AI Agents, Securing Frontier Intelligence for the Enterprise
- Infisical Agent Vault README
- Kite Agent Passport payments
- ServiceNow newsroom, 2026-10-15
- ServiceNow newsroom, 2026-10-21
- Socure Launches Agent Intelligence to Bind Every Agent to the Verified Human Behind It
- Visa Developer Center: getting started with Trusted Agent Protocol