API Authentication: OAuth 2.0 and JWTs

Unlike users who log in via browsers using cookies, software client tools authenticate with APIs on every request, usually passing tokens in the HTTP "Authorization" header.

A JWT is a self-contained, signed JSON payload split into three parts: Header, Payload, and Signature. The server signs the token, and the API gateway validates the token locally using a shared secret or public key without querying the database for verification.

OAuth is an authorization framework, not an authentication protocol. It allows third-party client tools to obtain limited access to resources (using scopes) on behalf of a user via delegation flows.