OAuth 2.1 token revocation (RFC 7009)

Revokes an access or refresh token belonging to the authenticated client. Always responds 200 for tokens owned by the caller, even when the token is already gone (RFC 7009 §2.2 anti-probing). Token type is advisory via token_type_hint; the server falls back to JWT shape sniffing and tries the other type if the hint misses.

Client authentication is required (per RFC 7009): pass client_id with optional client_secret via HTTP Basic, client_secret_post form fields, or just client_id for public clients registered with token_endpoint_auth_method: "none". Tokens belonging to a different client are silently ignored (still 200, anti-probing) but not revoked.