Revoke a key or refresh token

OAuth 2.0 token revocation (RFC 7009). A service account authenticates as for the token endpoint; revoking one of its keys ends the key and every access token exchanged for it. Access tokens are not revocable one by one (RFC 7009 section 2 lets a server decline): one sent here is answered with 200 and keeps working until it expires, at most an hour later. An unknown, expired or foreign token is answered the same way, so the response says nothing about it.

A native client signs a person out by sending its refresh token with its client_id and no secret, which ends that refresh token.