Inability to do immediate revocations is a real drawback and a valid complaint. If a trusted machine with a privileged token on it is compromised somehow, it w

Inability to do immediate revocations is a real drawback and a valid complaint. If a trusted machine with a privileged token on it is compromised somehow, it will likely take the attacker some time to search for and discover the token. If you use centralized auth and you realize there was a breach before this happens (say from monitoring/anomaly alerts), you can revoke the token and prevent unauthorized access. If your token is JWT and it doesn't expire for another 45 minutes, you're in much worse shape. This isn't the only factor to consider, but it's an important one.