The modern REST API implements token-based authentication. Here, tokens can be any strings generated by the server, which allows the client to access resources by producing a token. The token is computed in such a way that only the client and the server know how to encode/decode the token.
The previous example relates to session-based authentication. This has a limitation of managing sessions by saving them in the program memory, or Redis/SQLite3. JWT takes a different approach and creates tokens that can be passed around for authentication.
Whenever a Client passes the authentication details to the Server, the server generates a token and passes it back to the Client. The client saves that in some kind of storage, such as AWS Secrets Manager, a database, or local storage (in the case of a browser). The Client uses that token to ask for resources from...
