Combine Webhooks and Scheduled Polling to Minimize API Key Revocation Gaps

Engineering teams managing scoped API keys face a critical challenge: ensuring revocations propagate reliably to edge gateways that cache key status locally. Webhooks deliver revocation events within seconds but carry a hard risk — once a sender's retry budget is exhausted, dropped events leave no trace. Scheduled polling inverts this by giving the receiver control over liveness, though it introduces latency equal to roughly half the poll interval. Using both together means webhooks set the speed while periodic reconciliation sweeps verify what actually landed, with divergence counts serving as a live health signal for the push path. For audit purposes, the priority is not low median latency but the ability to reconstruct exactly when a key was revoked and how that revocation was confirmed — making an append-only intake log essential.