The problem with blacklisting auth tokens is that there is no token identification in the Graphcool token (no

jti

), so it's a bit harder to blacklist tokens.