# unsupported_token_type

The server does not support revoking or introspecting this type of token (RFC 7009 §2.2.1).

## Meaning

This server does not currently send this code. `/revoke` answers `200` for any token
it is given, including one it does not know or that belongs to another client, and
`/introspect` answers `active: false` for a token it cannot describe.

## Impact

None from this code.

## Diagnosis

A revocation of another client's token is recorded under `oauth.token.revoked` with
reason `access_denied` and cause `grant_client_mismatch`, though the client receives
`200`.

## Mitigation

- As a client developer: revoke only your own client's tokens; a `200` does not prove
  anything was revoked.
- As an operator: nothing to do.

## Escalation

If this server's response carries it, open an issue with the request id and the server
version.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.