Comment by RadiozRadioz

Then don't hit the SQL DB directly, cache the tokens in memory. Be it Redis or just in your app. Invalidate the cache on token expiry (Redis has TTL built in).

UserID -> token is a tiny amount of data.