JOSE is a Bad Standard That Everyone Should Avoid

Learn how to use JWT for Authentication

:closed_lock_with_key: Learn how to use JSON Web Token (JWT) to secure your next Web App! (Tutorial/Example with Tests!!)

Adding JSON Web Token API Keys to a DenyList

On token invalidation

Stop using JWT for sessions

And why your "solution" doesn't work, because stateless JWT tokens cannot be invalidated or updated. They will introduce either size issues or security issues depending on where you store them. Stateful JWT tokens are functionally the same as session cookies, but without the battle-tested and well-reviewed implementations or client support

Using JSON Web Tokens as API Keys

Compared to API keys, JWTs offers granular security, homogeneous auth architecture, decentralized issuance, OAuth2 compliance, debuggability, expiration control, device management