It's a good to have option for the end-users, although the protocol does not mandate this possibility. Imagine the following scenario:
The end-user starts to use an application that wants to access his google account data. So the end-user is redirected to google to approve the request. Once he approves the request, google issues access token to the third party application. Now the third party application can get end-users's google data. However, after 5 minuties of using this application, the user changes his mind about it, and decides that this application is suspicious, not trustworthy or he just does not like it. So he goes to google accounts, more specifically here:
And he can revoke the access token for that application. That means, that this token is just invalidated or deleted from google database, and the application will no longer be able to get end-user's google account data.
You don't need to see specific code in order to do this. If you are a OAuth provider, you surely have a DB table with tokens that are associated with a particular user id.
token <-> user_id
You then make a simple page, which does the following when your user visit it:
It sees which user id is visiting the page and selects all the tokens for that user from the database and display a simple link - revoke token next to each token. After the user click revoke token, you simply delete it :)
It's not rocket science at all and is a good option to have.