> I think the problem is that you need to either make the JWT have a short expiration or engineer a way to invalidate them before the expiration if the need to

> I think the problem is that you need to either make the JWT have a short expiration or engineer a way to invalidate them before the expiration if the need to do arises. That's not a problem. It's literally how they were designed to be used: expiration time and nonces.