Token revocation

Send a form-encoded request with token and client_id. Confidential clients must also authenticate with client_secret; public clients omit it.

curl -X POST https://api.zorveus.com/oauth/revoke \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=zrv_client_your_client_id" \
  -d "client_secret=zrv_client_secret_your_client_secret" \
  -d "token=zrv_oauth_token_to_revoke"

The response contains revoked: true when an active connection was revoked. Repeating revocation can return revoked: false. Remove the local token in either case and send the user through authorization again if they reconnect.