Token revocation (RFC 7009) — POST /oauth/revoke.
Accepts a refresh token or an access token, with an optional
token_type_hint. Must skip CSRF protection; answers no-store.
Always 200
RFC 7009 §2.2 is explicit: an unknown token is a success. The client asked for the token to stop working, and it does not work — that is the outcome it wanted. Answering 400 would turn this endpoint into a free oracle for testing whether a token exists.
Revoking a refresh token revokes its whole family. A caller asking to invalidate a token wants the session gone, not to be handed the token it was already rotated into.
An access token is revoked only with track_access_tokens: true; otherwise its
≤15-minute expiry is the bound. Its jti is read only after verifying the
signature with our own key — an unverified JWT's jti is attacker-chosen, and
acting on one would let anyone revoke anyone's tokens.