PubNub authentication servers cache valid and non-revoked tokens in memory for 60 seconds. After a revoke request is made, it might take up to a minute for an actively used token's cache to expire and a client to receive the expected 403: Forbidden error.
Why does revoking access not work immediately?
