Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
It seems that tokens created with no_expiry scope are immune to requests to invalidate them with /access-tokens/.../invalidate. Is this by design or by bug?
This should be fixed now.
Invalidation should be possible for any access token, regardless of its properties.