I want to create an endpoint for "logging out". Logging out in my case is basically removing an access token from the database. Therefore DELETE verb makes sense here, something like this: DELETE URL/tokens. Now in terms of rest it makes sense to have URL/tokens/, however it is generally not acceptable to put an access token in the url and rather should be put in the header. Doing the latter, however, would leave the endpoint as URL/tokens only which could imply deleting all the tokens. What do you think?
You are correct that passing sensitive information in URIs is a bad practice from a security perspective. The upshot is that doing so makes it more likely that the information will be exposed e.g. in web logs.
Doing the latter, however, would leave the endpoint as URL/tokens only which could imply deleting all the tokens.
There's some merit to this but I think you are overthinking things a bit. You could change the resource to URL/token (singular) which will make it pretty clear that the specific resource needs to be identified.