There’s a lot to say about the problems of JWTs, but they absolutely are extremely widely used for access tokens, and by many big players (Microsoft, Okta, etc)

There’s a lot to say about the problems of JWTs, but they absolutely are extremely widely used for access tokens, and by many big players (Microsoft, Okta, etc). The JWT RFC is a product of the OAuth working group.