JWT

A JWT (JSON Web Token) is a compact, signed token containing claims — user id, roles, expiry — that a server can verify using a signature, without looking anything up in a database. It makes authentication stateless: the token itself carries the proof.

Worked example: after login the server issues a JWT signed with its secret; the client sends it on each request, and the server verifies the signature and reads the claims to authorize — no session store needed. Gotcha: a JWT cannot be revoked before it expires (the price of statelessness), so keep lifetimes short and pair it with a refresh token; and never put secrets in the payload — it is signed, not encrypted, so anyone can read it.