Cookie is a mechanism to store and send tokens to the server, which is orthogonal to what the token is. You could store JWT in a cookie, or use opaque token in

Cookie is a mechanism to store and send tokens to the server, which is orthogonal to what the token is. You could store JWT in a cookie, or use opaque token in a HTTP header, for example. That said, the session cookies we loved back in the day were usually opaque tokens, yeah.