diff --git a/authority/provisioner/acme_test.go b/authority/provisioner/acme_test.go
index 51231ba3..2ffdd195 100644
--- a/authority/provisioner/acme_test.go
+++ b/authority/provisioner/acme_test.go
@@ -91,10 +91,10 @@ func TestACME_Init(t *testing.T) {
 func TestACME_AuthorizeRevoke(t *testing.T) {
 	p, err := generateACME()
 	assert.FatalError(t, err)
-	assert.Nil(t, p.AuthorizeRevoke(""))
+	assert.Nil(t, p.AuthorizeRevoke(context.TODO(), ""))
 }
 
-func TestACME_AuthorizeRenewal(t *testing.T) {
+func TestACME_AuthorizeRenew(t *testing.T) {
 	p1, err := generateACME()
 	assert.FatalError(t, err)
 	p2, err := generateACME()
@@ -120,7 +120,7 @@ func TestACME_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.prov.AuthorizeRenewal(tt.args.cert); err != nil {
+			if err := tt.prov.AuthorizeRenew(context.TODO(), tt.args.cert); err != nil {
 				if assert.NotNil(t, tt.err) {
 					assert.HasPrefix(t, err.Error(), tt.err.Error())
 				}
diff --git a/authority/provisioner/aws_test.go b/authority/provisioner/aws_test.go
index dd82ec9b..bb8e74f8 100644
--- a/authority/provisioner/aws_test.go
+++ b/authority/provisioner/aws_test.go
@@ -447,7 +447,7 @@ func TestAWS_AuthorizeSign_SSH(t *testing.T) {
 		})
 	}
 }
-func TestAWS_AuthorizeRenewal(t *testing.T) {
+func TestAWS_AuthorizeRenew(t *testing.T) {
 	p1, err := generateAWS()
 	assert.FatalError(t, err)
 	p2, err := generateAWS()
@@ -473,8 +473,8 @@ func TestAWS_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.aws.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
-				t.Errorf("AWS.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
+			if err := tt.aws.AuthorizeRenew(context.TODO(), tt.args.cert); (err != nil) != tt.wantErr {
+				t.Errorf("AWS.AuthorizeRenew() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
 	}
@@ -502,7 +502,7 @@ func TestAWS_AuthorizeRevoke(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.aws.AuthorizeRevoke(tt.args.token); (err != nil) != tt.wantErr {
+			if err := tt.aws.AuthorizeRevoke(context.TODO(), tt.args.token); (err != nil) != tt.wantErr {
 				t.Errorf("AWS.AuthorizeRevoke() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
diff --git a/authority/provisioner/azure_test.go b/authority/provisioner/azure_test.go
index 82ff095e..68e4adef 100644
--- a/authority/provisioner/azure_test.go
+++ b/authority/provisioner/azure_test.go
@@ -388,7 +388,7 @@ func TestAzure_AuthorizeSign_SSH(t *testing.T) {
 	}
 }
 
-func TestAzure_AuthorizeRenewal(t *testing.T) {
+func TestAzure_AuthorizeRenew(t *testing.T) {
 	p1, err := generateAzure()
 	assert.FatalError(t, err)
 	p2, err := generateAzure()
@@ -414,8 +414,8 @@ func TestAzure_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.azure.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
-				t.Errorf("Azure.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
+			if err := tt.azure.AuthorizeRenew(context.TODO(), tt.args.cert); (err != nil) != tt.wantErr {
+				t.Errorf("Azure.AuthorizeRenew() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
 	}
@@ -443,7 +443,7 @@ func TestAzure_AuthorizeRevoke(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.azure.AuthorizeRevoke(tt.args.token); (err != nil) != tt.wantErr {
+			if err := tt.azure.AuthorizeRevoke(context.TODO(), tt.args.token); (err != nil) != tt.wantErr {
 				t.Errorf("Azure.AuthorizeRevoke() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
diff --git a/authority/provisioner/gcp_test.go b/authority/provisioner/gcp_test.go
index 13a735ae..23e45b80 100644
--- a/authority/provisioner/gcp_test.go
+++ b/authority/provisioner/gcp_test.go
@@ -461,7 +461,7 @@ func TestGCP_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.prov.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
+			if err := tt.prov.AuthorizeRenewal(context.TODO(), tt.args.cert); (err != nil) != tt.wantErr {
 				t.Errorf("GCP.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
@@ -492,7 +492,7 @@ func TestGCP_AuthorizeRevoke(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.gcp.AuthorizeRevoke(tt.args.token); (err != nil) != tt.wantErr {
+			if err := tt.gcp.AuthorizeRevoke(context.TODO(), tt.args.token); (err != nil) != tt.wantErr {
 				t.Errorf("GCP.AuthorizeRevoke() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
diff --git a/authority/provisioner/jwk_test.go b/authority/provisioner/jwk_test.go
index 185f1596..4861b8c5 100644
--- a/authority/provisioner/jwk_test.go
+++ b/authority/provisioner/jwk_test.go
@@ -215,7 +215,7 @@ func TestJWK_AuthorizeRevoke(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.prov.AuthorizeRevoke(tt.args.token); err != nil {
+			if err := tt.prov.AuthorizeRevoke(context.TODO(), tt.args.token); err != nil {
 				if assert.NotNil(t, tt.err) {
 					assert.HasPrefix(t, err.Error(), tt.err.Error())
 				}
@@ -296,7 +296,7 @@ func TestJWK_AuthorizeSign(t *testing.T) {
 	}
 }
 
-func TestJWK_AuthorizeRenewal(t *testing.T) {
+func TestJWK_AuthorizeRenew(t *testing.T) {
 	p1, err := generateJWK()
 	assert.FatalError(t, err)
 	p2, err := generateJWK()
@@ -322,8 +322,8 @@ func TestJWK_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.prov.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
-				t.Errorf("JWK.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
+			if err := tt.prov.AuthorizeRenew(context.TODO(), tt.args.cert); (err != nil) != tt.wantErr {
+				t.Errorf("JWK.AuthorizeRenew() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
 	}
diff --git a/authority/provisioner/k8sSA_test.go b/authority/provisioner/k8sSA_test.go
index 31bf6d0a..692e7bab 100644
--- a/authority/provisioner/k8sSA_test.go
+++ b/authority/provisioner/k8sSA_test.go
@@ -219,7 +219,7 @@ func TestK8sSA_AuthorizeRevoke(t *testing.T) {
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
 			tc := tt(t)
-			if err := tc.p.AuthorizeRevoke(tc.token); err != nil {
+			if err := tc.p.AuthorizeRevoke(context.TODO(), tc.token); err != nil {
 				if assert.NotNil(t, tc.err) {
 					assert.HasPrefix(t, err.Error(), tc.err.Error())
 				}
@@ -230,7 +230,7 @@ func TestK8sSA_AuthorizeRevoke(t *testing.T) {
 	}
 }
 
-func TestK8sSA_AuthorizeRenewal(t *testing.T) {
+func TestK8sSA_AuthorizeRenew(t *testing.T) {
 	p1, err := generateK8sSA(nil)
 	assert.FatalError(t, err)
 	p2, err := generateK8sSA(nil)
@@ -256,8 +256,8 @@ func TestK8sSA_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.prov.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
-				t.Errorf("X5C.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
+			if err := tt.prov.AuthorizeRenew(context.TODO(), tt.args.cert); (err != nil) != tt.wantErr {
+				t.Errorf("X5C.AuthorizeRenew() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
 	}
diff --git a/authority/provisioner/noop_test.go b/authority/provisioner/noop_test.go
index a389b6b6..c79e7460 100644
--- a/authority/provisioner/noop_test.go
+++ b/authority/provisioner/noop_test.go
@@ -14,8 +14,8 @@ func Test_noop(t *testing.T) {
 	assert.Equals(t, "noop", p.GetName())
 	assert.Equals(t, noopType, p.GetType())
 	assert.Equals(t, nil, p.Init(Config{}))
-	assert.Equals(t, nil, p.AuthorizeRenewal(&x509.Certificate{}))
-	assert.Equals(t, nil, p.AuthorizeRevoke("foo"))
+	assert.Equals(t, nil, p.AuthorizeRenew(context.TODO(), &x509.Certificate{}))
+	assert.Equals(t, nil, p.AuthorizeRevoke(context.TODO(), "foo"))
 
 	kid, key, ok := p.GetEncryptedKey()
 	assert.Equals(t, "", kid)
diff --git a/authority/provisioner/oidc_test.go b/authority/provisioner/oidc_test.go
index 516e0f0e..e26ded0a 100644
--- a/authority/provisioner/oidc_test.go
+++ b/authority/provisioner/oidc_test.go
@@ -497,7 +497,7 @@ func TestOIDC_AuthorizeRevoke(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			err := tt.prov.AuthorizeRevoke(tt.args.token)
+			err := tt.prov.AuthorizeRevoke(context.TODO(), tt.args.token)
 			if (err != nil) != tt.wantErr {
 				fmt.Println(tt)
 				t.Errorf("OIDC.Authorize() error = %v, wantErr %v", err, tt.wantErr)
@@ -507,7 +507,7 @@ func TestOIDC_AuthorizeRevoke(t *testing.T) {
 	}
 }
 
-func TestOIDC_AuthorizeRenewal(t *testing.T) {
+func TestOIDC_AuthorizeRenew(t *testing.T) {
 	p1, err := generateOIDC()
 	assert.FatalError(t, err)
 	p2, err := generateOIDC()
@@ -533,8 +533,8 @@ func TestOIDC_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.prov.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
-				t.Errorf("OIDC.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
+			if err := tt.prov.AuthorizeRenew(context.TODO(), tt.args.cert); (err != nil) != tt.wantErr {
+				t.Errorf("OIDC.AuthorizeRenew() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
 	}
diff --git a/authority/provisioner/x5c_test.go b/authority/provisioner/x5c_test.go
index 477e3267..4fc4dbe0 100644
--- a/authority/provisioner/x5c_test.go
+++ b/authority/provisioner/x5c_test.go
@@ -554,11 +554,12 @@ func TestX5C_AuthorizeSign(t *testing.T) {
 	}
 }
 
-func TestX5C_authorizeSSHSign(t *testing.T) {
+func TestX5C_AuthorizeSSHSign(t *testing.T) {
 	_, fn := mockNow()
 	defer fn()
 	type test struct {
 		p      *X5C
+		token  string
 		claims *x5cPayload
 		err    error
 	}
@@ -618,7 +619,7 @@ func TestX5C_authorizeSSHSign(t *testing.T) {
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
 			tc := tt(t)
-			if opts, err := tc.p.authorizeSSHSign(tc.claims); err != nil {
+			if opts, err := tc.p.AuthorizeSSHSign(context.TODO(), tc.token); err != nil {
 				if assert.NotNil(t, tc.err) {
 					assert.HasPrefix(t, err.Error(), tc.err.Error())
 				}
@@ -706,7 +707,7 @@ func TestX5C_AuthorizeRevoke(t *testing.T) {
 	for name, tt := range tests {
 		t.Run(name, func(t *testing.T) {
 			tc := tt(t)
-			if err := tc.p.AuthorizeRevoke(tc.token); err != nil {
+			if err := tc.p.AuthorizeRevoke(context.TODO(), tc.token); err != nil {
 				if assert.NotNil(t, tc.err) {
 					assert.HasPrefix(t, err.Error(), tc.err.Error())
 				}
@@ -717,7 +718,7 @@ func TestX5C_AuthorizeRevoke(t *testing.T) {
 	}
 }
 
-func TestX5C_AuthorizeRenewal(t *testing.T) {
+func TestX5C_AuthorizeRenew(t *testing.T) {
 	p1, err := generateX5C(nil)
 	assert.FatalError(t, err)
 	p2, err := generateX5C(nil)
@@ -743,8 +744,8 @@ func TestX5C_AuthorizeRenewal(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := tt.prov.AuthorizeRenewal(tt.args.cert); (err != nil) != tt.wantErr {
-				t.Errorf("X5C.AuthorizeRenewal() error = %v, wantErr %v", err, tt.wantErr)
+			if err := tt.prov.AuthorizeRenew(context.TODO(), tt.args.cert); (err != nil) != tt.wantErr {
+				t.Errorf("X5C.AuthorizeRenew() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})
 	}