The credential carries the truth
Token authentication moves the truth into the credential itself.
Your server signs a token holding who the user is, their role and an expiry. Your client sends it in a header. Verification is a signature check inside the process. Nothing gets looked up, because nothing was stored.
Watch how many properties that one change reshapes. Any replica in any region authenticates any request with no shared store on the path. Your auth service can be entirely down and existing sessions keep working, with only new logins failing.
Look at the cross-service case, the big one. In a system of a dozen services, session lookups mean every service calling one central store on every request. That is added latency plus a single point of failure with enormous fan-out.
With signed tokens each service verifies locally against a cached public key, and that outage domain shrinks to nothing.
The bill
Now read the bill. Revocation gets hard, hard enough that this course gives it a whole lesson of its own. A signed token stays valid until it expires, no matter what your user did in the meantime.
Size grows: a realistic token runs around a kilobyte against 32 bytes for a session identifier, paid on every request. Claims go stale, so a role change waits for the next refresh. And whoever holds a bearer token is the user, so TLS and careful storage on the client stop being nice-to-haves.
Reach for them when your topology demands it. APIs consumed by many services, mobile clients, cross-domain setups where cookies fight you, deployments spread across regions.
Watch for the tell that you overcorrected. If you find yourself checking a denylist on every single request, you have rebuilt sessions with extra steps and worse ergonomics.
Worked example
Wei's team at a payments company runs nine internal services behind an API gateway, and originally every service called the central session service on every request, adding 8 ms at p50. In March, a session service incident took the entire product down for 40 minutes even though all nine services were healthy, which got executive attention. The team moved to RS256 JWTs with a 10-minute expiry: the gateway handles login and token issuance, and each service verifies signatures locally with public keys cached from a JWKS endpoint. The next auth incident, in August, blocked new logins for 12 minutes while every already-authenticated user sailed through unaffected, downgrading a SEV1 to a SEV3. The tradeoff went into the design doc in bold: a banned merchant retains API access for up to 10 minutes, and compliance signed off on the window explicitly.