I went through a similar journey when trying to figure out how to revoke JWTs, i.e. forcefully sign out everywhere. We ended up on the following: Either you ac

I went through a similar journey when trying to figure out how to revoke JWTs, i.e. forcefully sign out everywhere. We ended up on the following: Either you accept the fact that once signed, it has a life on its own until it expires, or the issuer becomes the single point of failure. Another issue we dealt with was validating that the person doing the request with a JWT was the owner of the JWT, and not someone who stole it. A possible fix? Distribute private keys to clients, and have them sign the JWTs on the fly. How do you check for revoked private keys? Catch-22.