OAuth tokens are revoked by the user from the application side, on the API Access screen. To get there, click on the dropdown in the upper right (next to your user name), select Account Management. From there, click on API Access in the left nav bar.

You should see a list of all your API keys and OAuth tokens. To revoke an OAuth token, click Delete Access Token.

Thank you for your reply @hoyan.leung. We have been using API Partner accounts for testing. They do not have the ability to revoke access tokens (Account Management > API Access) from the account UI. I created a normal user account and was able to revoke access tokens from the account. Any particular reason for not providing this feature to API Partner accounts?