IssueTracker

This will create a public issue which anybody can view and comment on.

According to [1] for revoking OAuth token using API call, just need to know the token.Here no other authentication is required. For enhancing the security  might need to have proper authentication as well as IAM permission for revoking access tokens.
 
[1]-https://developers.google.com/identity/protocols/oauth2/web-server#tokenrevoke
 
Problem you have encountered:
Using curl command/API call for revoking OAuth token, users need to place the token only rather any other authentication as well as IAM condition

What you expected to happen:
For enhancing security, need to have proper authentication process as well as IAM permission for revoking token.  

Steps to reproduce:

[2]-https://developers.google.com/identity/protocols/oauth2/

Other information (workarounds you have tried, documentation consulted, etc):
NA