There are two common mechanisms for invalidating tokens: * Store the invalidated tokens in some fast store, in memory store and check that before accepting tok

There are two common mechanisms for invalidating tokens: * Store the invalidated tokens in some fast store, in memory store and check that before accepting tokens. * Have auth tokens be very short lived (e.g., 1 minute) and require the use of a "refresh token" to get a new auth token when it's expired. This is the mechanism used by OAuth 2 (which strangely is never mentioned in the article). The refresh tokens should be random strings stored in a db, and they can be simply deleted on invalidation.