1.2.1 JWT and OAuth
OAuth 2.0 lets a user grant an app limited access. A JWT is a signed JSON token the API can verify without a session lookup (until you need revocation).
Why it matters
Stateless auth scales horizontally. OAuth is how “Sign in with Google” and third-party API access work.
How it is used
Prefer short-lived access tokens and rotate refresh tokens. Validate iss, aud, and expiry. Store secrets for signing in a vault, not in git. Treat JWTs as credentials — HTTPS only.