> Maybe they did it so they could have independent backends (instead of having to share session keys across load balanced api servers). Since at some point the

> Maybe they did it so they could have independent backends (instead of having to share session keys across load balanced api servers). Since at some point the loginkey was based on the unencrypted password that means that they either had to store the PW in clear (and fetch them from the DB) or generate the key at account creation and fetch it from the DB anyway. A good strategy to check the token validity without reaching the DB is to sign it cryptographically. The loginKey can be $randomString+sign($randomString). The endpoint can check the signature before doing more costly things like a network request.