It seems that tokens created with no_expiry scope are immune to requests to invalidate them with /access-tokens/.../invalidate. Is this by design or by bug?
This should be fixed now.
Invalidation should be possible for any access token, regardless of its properties.
3 years ago