IMHO the stateful opaque token approach is simple enough that it can (and often does) get baked into whatever language/framework you’re using to write your app.

IMHO the stateful opaque token approach is simple enough that it can (and often does) get baked into whatever language/framework you’re using to write your app. In addition, the very nature of session tokens is such that the logic for what the token actually means/represents lives in your app, on the server. So, that may be why we don’t see more “opaque session token” standards/libraries out there as an alternative to JWTs. But if you want an existing example, Devise for Rails [1] has been around a while. [1] https://github.com/heartcombo/devise https://github.com/heartcombo/devise