> revoke the refresh token, you have to maintain a blacklist somewhere Store CreationDate in the refresh token. Store RefreshTokenInvalidBefore in the user rec

> revoke the refresh token, you have to maintain a blacklist somewhere Store CreationDate in the refresh token. Store RefreshTokenInvalidBefore in the user record. When refresh is attempted, if Token.CreationDate <= User.RefreshTokenInvalidBefore, reject the refresh. The only drawback here is that it would sign the user out on all devices. However, assuming this is because of a password or token compromise, that's likely the least of their worries.