I have to agree. A JWT contains within it 'claims' that are the authorization for allowed behaviour against the API. Authentication happens before the JWT is is

I have to agree. A JWT contains within it 'claims' that are the authorization for allowed behaviour against the API. Authentication happens before the JWT is issued. I think the problem is that it's not about issuing just one JWT, you need a 'refresh' token and a 'security' token. The security token expires quickly, but a new security token can be issues using the refresh token which has a long expiry. You can even make the refresh token single use with the action of refreshing the security token returning you a new refresh token. This, however, needs to be handled carefully within the UI as two requests using the same refresh token would invalidate the 'session'. The reasoning is that the api can trust the claims within the security token, but has no need to access external sources to validate the token. The refresh token can have security policies applied to it as well as 'user logged out' checks against the refresh token. This keeps the API requests extremely fast with only an intermittent (once a minute) need to get a new security token.