It's funny to read about all the web app usage of JWT, and here I am dealing with it server side. For those unaware, JWT has the 2 ways of encoding it: JWS and

It's funny to read about all the web app usage of JWT, and here I am dealing with it server side. For those unaware, JWT has the 2 ways of encoding it: JWS and JWE. Because of these properties, you can use it how people would use it for application level messaging. If you are already on a secure channel, you can sign or encrypt the message so application level checks can happen. This makes it act like a replacement of PGP for you paranoid people out there. (Btw, I recommend against this, and think people should use PGP or Tink, as it's easy to footgun yourself with JWS.)