I think the only two ways to use JWT tokens is: 1) you have some kind of api gateway, it would validate the session, issue JWT/PASETO that lives a minute or so

I think the only two ways to use JWT tokens is: 1) you have some kind of api gateway, it would validate the session, issue JWT/PASETO that lives a minute or so, downstream services would use that token to talk to complete the request. 2) When you need something like AWS S3 presigned URL. Everything else is just an opaque session token with extra steps.