JSON Web Tokens (JWT) Why you should not use JWT HN Why JWTs Suck as Session Tokens Related The complete guide to protecting your APIs with OAuth2 (part 1) HN