How does one define a revocation list?

[alecthomas]

The only mention I can see of revocation is for retrieving, how do I revoke a token?

[divarvel]

the library does not offer helpers for these yet, so for now you are supposed to handle the revocation list yourself before running the authorizer.

Other libs like biscuit-haskell include this check during parsing to abort parsing as early as possible (you can revoke a token before verifying signatures and parsing block contents)