Agreed, SAML to JWT is an excellent comparison. But IMO it is fair to say you can't invalidate JWTs. More precisely, if you want the ability to invalidate ind

Agreed, SAML to JWT is an excellent comparison. But IMO it is fair to say you can't invalidate JWTs. More precisely, if you want the ability to invalidate individual JWTs (oops, John's been hacked), then you'll need some kind of per-request check against an authorization server. And if you're doing that, why bother with JWTs in the first place, rather than pack information into the token you might as well pull it from the auth server. But there are several use cases where you want to - and can easily - invalidate an entire group of JWTs. For example, we have multi-tenant apps, and it could be you want to invalidate all the JWTs for a single tenant (oops, Fred's Fruit Barn has been hacked). That can be done in different ways, the simplest being that all JWTs issued prior to some date are invalidated.