JWT vs opaque tokens
What this is
Opaque tokens are random ids; the API introspects them at the issuer. JWTs are self-contained; the API verifies a signature and reads claims offline. JWTs scale (no lookup) and are hard to revoke before exp. Opaque tokens revoke instantly and stay small. Resource servers that must work offline pick JWT; high-security revocation picks opaque or reference tokens.
FAQ
- Can I put PII in a JWT?
- Assume every JWT will be decoded by the client and by logs. Keep PII out of access tokens; use opaque tokens or encrypted JWE if you must.