you can implement blacklisting caching yourself by: - Switching off blacklisting from supertokens' side (which is the default) - Post session verification, check your cache for that session ID (we call this

sessionHandle

). If your cache (blacklist) as this, then disallow the API call by returning a 401. - When calling sign out, or revoking the session some other way, add the session handle to your blacklist