Revoke a token

Client authentication can be provided either:

1. In the request body using client_id and client_secret parameters, or
2. Using HTTP Basic authentication with client_id as username and client_secret as password

If both are provided, Basic authentication takes precedence.

Invalidates either an access token or refresh token. Use this endpoint when:

• A user logs out
• A token may have been compromised
• You want to clean up unused tokens

Note: Revoking a refresh token will automatically invalidate any access tokens generated from it.