API Authentication

JSON Web Tokens (JWT) vs Sessions

JWTs are stateless. The server signs a payload containing the user ID, and the client sends it back in the Authorization: Bearer header. Because the server doesn't store the session, scaling is easier, but instantly revoking a specific token is difficult.

Session cookies are stateful. The server stores the session ID in a Redis cache. This allows instant revocation, but requires a central data store.

Security for Frontend

If you are building a SPA (Single Page App), do not store JWTs in localStorage as they are vulnerable to XSS. Store them in httpOnly cookies whenever possible.

Need to inspect a token? Use our JWT Decoder Tool.