If the Refresh Tokens are leaked, you revoke them and the user has to re-authenticate. It's crucial that clients are able to respond to their refresh tokens be

If the Refresh Tokens are leaked, you revoke them and the user has to re-authenticate. It's crucial that clients are able to respond to their refresh tokens being revoked. The good thing is that it is a standard workflow, contrary to API key being revoked, which is generally not handled (most people hard-code API key in their client).