Revoke Endpoint

OAuth 2.1 token revocation endpoint (RFC 7009).

Revokes access tokens or refresh tokens. Always returns 200 (even if token doesn't exist).

Request Body: token: Access token (JWT) or refresh token (opaque) client_id: OAuth client ID

Returns: 200 OK (always, per RFC 7009)

Security Notes: - Always returns 200 to avoid leaking token existence - Rate limited per client - Validates client_id matches token owner - Supports both access tokens (JWT) and refresh tokens (opaque)

Example Request: { "token": "eyJhbGc...", "client_id": "client_abc123" }

Example Response: { "success": true }