JWT 101

Why tokens, not cookies, for an API

A browser juggling a session cookie makes sense for a website — the browser has a cookie jar and sends it back automatically. PawWalk's real clients are the iOS app (and later Android) — no cookie jar, no browser. What they need is a portable, self-contained proof of identity they can store themselves and attach to every request by hand: a JWT (JSON Web Token).

This is exactly the string the iOS app got back from /signup and /login and stored in the Keychain, then sent back as Authorization: Bearer <token> on every request after that. Module 10 is where that token actually gets minted and checked, server-side.