Comment by rad_gruchalski

Don't they still require some state to be able t invalidate refresh tokens?