> Anyway, I have always understood it as the token being opaque for the verifier too Which falls flat on its face the second you realize the "verifier" can pul

> Anyway, I have always understood it as the token being opaque for the verifier too Which falls flat on its face the second you realize the "verifier" can pull out information based upon that opaque token. It just means the intent is not for the person receiving it to do anything except reflect it back on subsequent requests. That's it. Typically it's done by handing something that is meaningless without context, said context not being available to the consumer being issued the token. But there is absolutely nothing that says you can't hand them a JWT meant to be used as an opaque token. If you're really worried about it, encrypt that bad boy before giving it to them.