JWT tokens

After login, then what?

Hashing solves proving who you are once — at login. But HTTP is stateless: the next request PawWalk makes (list my bookings, start a walk) arrives as a fresh connection that knows nothing about the login that just happened. Something has to travel with every request to say "I'm the walker who logged in a minute ago."

That something is a token. When login succeeds, the server hands the client a token; the app stores it and attaches it to every later request. The classic way to make that token trustworthy without a database lookup on every call is a JWT — a JSON Web Token.