> Revoking a bearer token for multiple services is an open loop problem, where you can't know if all services... What is a service here? A bearer token is mean

> Revoking a bearer token for multiple services is an open loop problem, where you can't know if all services... What is a service here? A bearer token is meant solely for the AS. Revocation of a bearer token only means something in the context of the AS. Now if one wants to build some AS feature to go tell every protected resource "there's an access token good for another 15 minutes - I revoked its bearer token so don't honor that access token" one can build such a thing, but it is going to be some particular custom aspect of the implementation shared between the AS and resource servers. Since OAuth only really profiled two patterns for interoperability between the two (stateless sharing via JWT, stateful endpoint via introspection service), the only real interoperable approach is to make a introspection call each time you evaluate the access token. At a massive distributed scale like with someone like Google, such introspection decisions would have to be pushed closer to the nodes as a distributed system itself, which means it becomes eventually consistent. You have to decide whether a complex stateful system is worth it considering natural access token expiry on its own also essentially makes revocation eventually consistent.