Inactive token still works

Is your resource server using the introspect endpoint to see if the token is still valid (remote token validation) or is it checking the signature and ‘exp’ value in the token (local token validation)? If you’re not sure and you are using one of our JWT verifier libraries, these are designed to do local token validation (as it does not require a network call).

Only the introspect endpoint can tell you if a token has been revoked, while local validation will continue to consider the token valid based on the token lifetime instead. See our guide about token validation for more details.