Revoking stateless JWTs is tricky. Your options:
Short expiration: -minute tokens limit damage window. Requires refresh token rotation.
Token blocklist: Store revoked token IDs in Redis. Check on every request. Adds latency.
Token versioning: Store version per user. Increment on logout. Reject tokens with old versions.
Refresh token revocation: Can't revoke access tokens, but refuse to issue new ones.
For high-security systems, combine short-lived access tokens with server-side refresh token tracking.