End a session

Ends the session the refresh token belongs to, immediately — no grace window applies. If the token was spent moments ago by a concurrent refresh, its successor is revoked too, so the session still ends. The access token stays valid until it expires — that is inherent to stateless JWT — so a client should also discard its own copy of both tokens.

Refuses API-token auth: a token minted for automation must not be able to end its owner’s interactive session.