How are consent and access revocation handled?

Short answer

Consent governs what an application may receive and when. Users and administrators should be able to revoke access so subsequent verifications fail closed for that publisher relationship. Public Keyra messaging highlights privacy and consent focus; implementers must wire revocation to token invalidation and webhook or polling updates as documented.