Token and revocation endpoint should be https://dev.local/xf23/index.php?api/oauth2/... Continue reading...