For almost all API calls, I pass both my key and my access_token. This doesn't exactly make sense for the "de-authenticate" endpoint, as the access token is already in the URL. Passing one anyway yields a rather unhelpful 500 error, although the user is successfully deauthenticated.

I've put together a quick page to show the error:

http://withoutthesarcasm.com/stackapps/bug/

The "error" link will de-authenticate with the access_token passed as a GET parameter as well as in the URL, and the "OK" link will de-authenticate without passing the access_token as a GET parameter.

Probably a low severity bug, but I thought I'd report it anyhow.