For any server-based application, one challenge that must be solved is authentication, and our RESTful server therefore will need a solution for that. In traditional web pages, sessions and cookies may be used, but if you are using an API, there's no guarantee that requests will come from a browser; in fact, they may very well come from another server. Adding this to the fact that HTTP is stateless, and that RESTful services are also supposed to be so, we need another mechanism, and JSON Web Tokens (JWT) is an often used solution.
JWT is sometimes read aloud as JOT; see Section 1 of the RFC at https://www.rfc-editor.org/info/rfc7519.
The idea with JWT is that the client will first exchange valid credentials (such as username and password) with a server and get back a token, which will afterwards give them access to the server's resources...
