From df7ca1329e88715b49122b3bb93d2b047498c4ab Mon Sep 17 00:00:00 2001 From: Andy Dixon Date: Thu, 26 Feb 2026 12:22:20 +0000 Subject: [PATCH] docs: note session invalidation behavior for disabled accounts Document that provider-side account disablement can invalidate existing authenticated sessions, not just new login attempts. --- docs/INTEGRATION_GUIDE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/INTEGRATION_GUIDE.md b/docs/INTEGRATION_GUIDE.md index 5c027ee..dbfa722 100644 --- a/docs/INTEGRATION_GUIDE.md +++ b/docs/INTEGRATION_GUIDE.md @@ -138,6 +138,7 @@ try { `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time. Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion. WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid. +Existing authenticated sessions may also be invalidated when account status changes to disabled. ## Operational guidance