Revoke a short-lived bearer access token per RFC 7009 without rotating the underlying client credential.

Client authentication. Two methods are supported:

• HTTP Basic (recommended): send client_id:client_secret Base64-encoded in the Authorization: Basic ... header.
• POST body: include client_id and client_secret in the request body alongside token.

Sending credentials via both methods in the same request is rejected with invalid_request. Authorization: Bearer is not accepted for this endpoint.

Request format. Both application/x-www-form-urlencoded and application/json are accepted.