Step 0 of 0
When to Use
JWT for stateless microservices auth. OAuth 2.0 Auth Code for delegated authorization ("Login with Google"). Client Credentials for machine-to-machine / service-to-service calls with no user context.
Trade-offs
JWTs can't be revoked before expiry — use short TTL (15min) + refresh tokens. OAuth adds complexity. Never store tokens in localStorage — use httpOnly cookies to prevent XSS. Refresh tokens need secure storage.
Interview Tip
"JWT validation is stateless — the API verifies the signature without a DB hit, which is what makes it scale. But revocation requires a token blacklist in Redis, or short TTL with refresh. Always ask: what's the token lifetime?"