title: Manually expire JWT token from server - WEB API 2
body: <p>I am working on a api server which revives requests from a mobile app. I am using <code>JWT</code> with <code>ASP.Net MVC Web API 2</code>. In this Admin gives access of various departments to mobile app users. I set these DeptIds in <code>Claims</code> at the time of Login. On every authorised request from app, in a custom action filter attribute I read claims to match deptId in request URL with claims. This all scenario works fine.</p>
  
  <p>Now my problem is, when Admin revokes access of any particular dept from app user, how should I expire the <code>access_token</code> of that user so that, on Login request call, I can set new <code>Claims</code>. Otherwise, as Admin removes access from server but the deptId still exists in user's <code>Claims</code> so user still have access to that department.</p>
  
  <p>One way is on every request, check in database for access but that increases overhead of server also increases response time. So I don't want to go this way.</p>
  
  <p>I didn't find anything on web how to expire token in <code>JWT</code>. Can any one help on this?</p>