Hacker News Reader

>rarely talking about the hard things like logout

Why hard?

You can always black list them

But then you have have make a database call to check the blacklist, so you might as well use sessions

I'm not sure about it, but what if Logout just removed token from client meanwhile "Logout from all devices" black lists token?

I tend to believe that it could be used by gmail, but it's just a guess

If you're blacklisting tokens at any point in your application, you then need to check this blacklist.