Glossary
JWT
Meaning and details
A JSON Web Token is a self-contained credential. The server signs a small JSON payload (user id, expiry, roles) and hands it to the client; the client sends it with every request; the server verifies the signature and tr...
JWT meaning
JSON Web Token: a signed token that carries identity claims so an API can authenticate requests without a session store.
What is JWT?
A JSON Web Token is a self-contained credential. The server signs a small JSON payload (user id, expiry, roles) and hands it to the client; the client sends it with every request; the server verifies the signature and trusts the claims. No session table, no lookup on every request: the signature is the proof.
Why it matters to an indie builder: JWTs are the reason a stateless API on a $5 VPS can serve thousands of authenticated requests. They pair naturally with mobile apps, SPAs and APIs consumed by other services, and every major auth provider (Clerk, Auth0, WorkOS, Better Auth) issues them behind the scenes.
A concrete example: after login, your API returns a token whose payload reads {"sub": "user_841", "role": "admin", "exp": 1760000000}. Your frontend stores it and attaches it as an Authorization header. Your API verifies the signature in microseconds and reads the role directly: no database call. When the expiry passes, the client refreshes the token once.
Common mistakes, and they are all common in production incidents: treating the payload as secret (it is base64, anyone can read it; never put email, address or tokens inside), skipping expiry (a leaked token then works forever; keep exp short and use refresh tokens), signing with a weak or shared secret, and storing tokens in localStorage on sites with any XSS exposure (httpOnly cookies are safer for browsers). One more: JWTs cannot be individually revoked. If you need instant logout or banning, keep a lightweight denylist of revoked token ids in Redis, or fall back to short expiries so the window of abuse is minutes, not days.
Most indie teams should not hand-roll any of this. Better Auth, Clerk and WorkOS issue, rotate and refresh tokens correctly for you, and their managed flows handle the edge cases (clock skew, key rotation) that cause 2am incidents. Reach for raw JWT libraries only when you need something the providers cannot give you.