Revocation is done in the ShareWith app or API. The ShareWith OIDC service does not handle the refresh tokens; those get handled by your upstream SSO. It's entirely up to whatever application is consuming our OIDC to decide how to set cookies that would make the session short or long lived. In the case of OAuth2Proxy, the default cookie lasts 5 minutes.