That is a great call out. Absolutely I agree! The JWT ID would be a good claim to use to store this information.

I was just trying to leave it open here and not get claim specific, leaving out the implementation details :)