Question about best practices to revoking a JWT

From what I have read I see two approaches. You can use a per-user secret to sign a token. When the user wants to invalidate, change the per-user secret. Of course this will invalidate all issued tokens so no fine grain control.

Another approach is to use the jti field. Store all the jti's issued per user in a database. When a user wants to invalidate remove that jti. When receiving a token check if the jti is in the database for that user. Of course this is done after validating the integrity of the token and the database is kept up to date automatically removing jti’s that have expired. This offers fine grain control.

Do other approaches exist? Can either of these be considered best practice?