Authentication with tokens

Establishing who is calling

A signed token lets you verify the caller without a database lookup per request. Verify the signature, the issuer, the audience, and the expiry — skipping any of those turns the token into a decorative header.

Short-lived access tokens with a refresh mechanism limit the damage from a leaked token. A token valid for a year is a password with worse handling.

Storage on the client is the weak point. A token in local storage is readable by any script that gets injected; an http-only cookie is not, at the cost of needing cross-site request protection.