We decided to use JWT internally, and force clients through an API gateway that converts between a classical session key (stored in a fast, distributed key/valu

We decided to use JWT internally, and force clients through an API gateway that converts between a classical session key (stored in a fast, distributed key/value store) and an internal JWT. This means that internal microservices don't need to deal with session management at all (including revocation), and only need to worry about validating the public key of the signer. Yet if anything is accidentally exposed (let's say a microservices fetches a user-provided URL, and the URL is localhost), the user still cannot spoof an identity without having the signer's private key. The internal JWT also has a very short TTL, so accidental leakage wouldn't cause much trouble. I would not use JWT for session management.