You should probably be using refresh tokens (https://auth0.com/blog/2015/10/07/refresh-tokens-what-are-they-and-when-to-use-them/ https://auth0.com/blog/2015/10

You should probably be using refresh tokens (https://auth0.com/blog/2015/10/07/refresh-tokens-what-are-they-and-when-to-use-them/ https://auth0.com/blog/2015/10/07/refresh-tokens-what-are-th...) to invalidate sessions on a change-password event for example.