Comment by DavidSharff

You can track JWTs on the server, via a sessionId or whatever you wish, it just breaks the intended pattern. If you have to do a lookup on each request (necessary to invalidate the token imperatively) your JWT is no longer stateless which is a core tenet of the JWT approach.

It'd be like building a React app and calling getElementById(id) to update DOM values. You _can_ do it but...