RealtimeKit adds custom token validity windows and per-token revocation

RealtimeKit has been updated to let you embed not_before and expires_on timestamps in the token object returned when adding a participant. Previously every token was hard‑coded to a 100‑day lifespan. The new fields are optional, so existing integrations continue to receive long‑lived tokens unless you explicitly set a window.

Custom token validity windows

By supplying ISO‑8601 timestamps for not_before and expires_on, you can restrict a token to the exact period a meeting is scheduled to run. A token that is not yet valid or that has passed its expiry is rejected before the participant joins, which also means the platform does not charge for those attempts.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/realtime/kit/$APP_ID/meetings/$MEETING_ID/participants" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "name": "Mary Sue",
    "preset_name": "",
    "custom_participant_id": "",
    "token": {
      "not_before": "2026-12-01T15:00:00Z",
      "expires_on": "2026-12-01T17:00:00Z"
    }
  }'

Both fields are optional; omitting them falls back to the default 100‑day window.

Single‑token revocation

RealtimeKit now supports revoking an individual token without marking the entire meeting inactive. When a token is revoked, the associated participant is removed from the meeting if they are present. Revocation propagates within roughly 60 seconds; if you need an immediate block, delete the participant instead.

Operational considerations

• Store the not_before and expires_on values alongside participant metadata to audit token lifetimes.
• Monitor the 60‑second revocation window if you rely on instant removal for compliance or abuse mitigation.
• Refresh tokens via the provided Refresh Participant Token API when a session needs to be extended beyond the original window.
• Ensure your API token has at least one of the required permissions – Realtime Admin or Realtime – to use these features.

Security implications

Limiting token validity reduces the time window an attacker could reuse a leaked token, aligning token lifespan with the actual business need. Revoking a token removes its ability to join, but the propagation delay means there is a brief period where a revoked token could still be accepted. Treat revocation as a soft control and combine it with participant deletion for high‑risk scenarios.

Related CloudNinjas coverage: hands-on guides.

What This Means For Practitioners

• Update your participant‑creation workflow to include not_before and expires_on when sessions have a known schedule.
• Implement a revocation routine that calls the token‑revoke endpoint and, if immediate removal is required, also deletes the participant.
• Adjust billing alerts to account for the fact that expired or revoked tokens no longer generate usage charges.
• Review your permission model to ensure the service account used for RealtimeKit calls has the appropriate Realtime or Realtime Admin scope.