Authenticating web service requests
Applications can’t rely on forms to authenticate web services because clients may not be browsers and cannot be relied on to render HTML.
Web service clients can use cookies – because they are a standard part of HTTP – but session cookies can often cause problems because the session expiry is often set to suit round-trip clients, where every user interaction refreshes the cookie. Web service clients only send requests when they need data, and the frequency of requests can be so low that sessions expire too quickly to be useful.
Applications can address the lack of HTML support by providing an API to present credentials as JSON data. Instead of a cookie, the authentication API produces a bearer token, which is a string that can be included in requests, much like a cookie, but with its own lifecycle and without the dependency on sessions.
The most common form of bearer token is the JSON Web Token (JWT) standard,...
