Token-Based Auth (JWT)

Use signed tokens to propagate identity and authorization claims.

auth

Detailed Description

JWTs work well for stateless identity propagation.

Use short expirations, key rotation, and careful claim design.

Visual Diagram

JWT Flow
  Client → POST /auth/login
  AuthSvc → signs JWT { userId, roles, exp }
  Client → sends JWT in Authorization header
  ServiceA → verify signature locally ✓
  ServiceA → extract userId, roles from payload
  Stateless — no session store needed

Tradeoffs

Pros

Stateless validation, works across services

Cons

Revocation and claim freshness are hard

Examples: jsonwebtoken, jose, Auth0, Keycloak, Cognito