Hacker News Reader

Can't you revoke them the same way you revoke any other auth token and put the token ID in a database somewhere?

it won't be stateless then, and you might as well just use traditional sessions then