Unless they are public, clients must authenticate to the server with registered credentials such as client secret in order to make tokoting token.
Unless they are public, clients must authenticate to the server with their registered credentials, such as client secret, in order to make a token revocation request.