Looks good. So you can store oauth on server, which should be safer. Is it possible for an oauth client to "suicide" on its permission? I'm thinking, in case a

Looks good. So you can store oauth on server, which should be safer. Is it possible for an oauth client to "suicide" on its permission? I'm thinking, in case a third-party service is comprised, they can just ask the oauth server to abandon their permission to avoid further loss for users.