OptionalallowOptionalisOptionalmaxOptionalnowAdd a jti to the server's deny-list. The authenticator's isRevoked
should consult the same store so future joins with this token are rejected.
exp is the revoked token's expiry (seconds since epoch) when known —
stores use it to prune deny-list entries once the token would have
expired on its own.
Secret used to verify the target + bearer tokens.
Deny-list check — a bearer whose own
jtiwas revoked (e.g. a kicked admin) must not be able to keep revoking other people's links.