In addition to single token revocation, you can use the account epoch approach (at least that's what I call it): Store an "epoch" date in the database for each

In addition to single token revocation, you can use the account epoch approach (at least that's what I call it): Store an "epoch" date in the database for each account. Tokens issued for that subject are considered invalid if they were issued before the epoch. This allows you to do mass token revocation (e.g. sign out all active sessions) without knowing the IDs of the tokens that have been issued.