Function token_refusal 

pub(crate) fn token_refusal(err: TokenError) -> Refused

What a refused exchange or refresh answers, and how loudly it is written.

warn is a presentation that looks like a stolen credential (a refresh token used twice, a proof under another key), a client whose authentication no longer matches its metadata, and a grant this server could not keep. The rest is ordinary expiry, a caller’s mistake, or this server’s policy, at info.