You do need a database if you want the ability to log users out server side. This is usually done through a second refresh token.