AD: I wrote a library that can deal with this for JWT https://github.com/endiangroup/compandauth https://github.com/endiangroup/compandauth The skiny is that y

AD: I wrote a library that can deal with this for JWT https://github.com/endiangroup/compandauth https://github.com/endiangroup/compandauth The skiny is that you place a copy of some monotonic counter inside every JWT you issue, you keep track of the counter server side and compare with each request's JWT copy + some delta (which is the equivalent of maximum number of concurrent sessions you wish the user to have).