A session from eight hours ago shouldn't be enough to revoke every API key. Step-up authentication requires a fresh sign-in right before the action that matters, GitHub's sudo mode, in your Next.js app.
workos.com/blog/step-up-a…