You should always invalidate the token once you receive a delete
event in the webhook
use SSOfy\APIClient;
...
$client = new APIClient($config);
$client->invalidateTokenCache('TOKEN');
In case for some reason the cache for a particular token could not be erased or the events weren't delivered to your webhook, make sure to invalidate all tokens to let the SDK reevaluate the verifications:
use SSOfy\APIClient;
...
$client = new APIClient($config);
$client->purgeTokenCache();