Disconnect

Token revocation (RFC 7009). Either of a connection’s current tokens ends the whole connection: the person consented once, so there is one thing to end. A token that is unknown, malformed, replaced, already revoked or expired answers the same empty 200, as the RFC asks. A token issued to another client is refused (invalid_client, 401) and nothing is revoked. Public clients only: send client_id, and no Authorization header, client_secret or client_assertion (each is refused invalid_client, 401).