Exchange a token request for an Ably Token (TokenDetails). Two request forms are accepted: - A signedTokenRequest (carries a mac computed with the API key secret). No Authorization header is required — the mac is the credential. This is how an untrusted client redeems a request its server signed. - An unsignedTokenParams body. Requires HTTP Basic authentication with the API key; Ably signs the token server-side. The effective capability of the returned token is the intersection of the requested capability and the issuing key’s own capability; an empty intersection fails the request.
Revoke tokens previously issued from this API key. The key MUST have had revocable tokens enabled before the tokens were issued. Requires HTTP Basic authentication with the API key — a client authenticated with a token (rather than the key) is rejected with Ably error 40162. Targets are specified as type:value strings — clientId:<id>, revocationKey:<value> (matches the x-ably-revocation-key JWT claim), or channel:<name>. issuedBefore scopes revocation to tokens issued before a timestamp; allowReauthMargin postpones enforcement ~30s and hints live connections to re-authenticate first.