I was wondering about this too. The project explicitly states it as a non-goal, which seems odd to me as I haven't dealt with a REST api that was session based

I was wondering about this too. The project explicitly states it as a non-goal, which seems odd to me as I haven't dealt with a REST api that was session based in a decade. Pretty much everything is JWT based. Honestly, I can't think of any commercial software I've been involved with or API interfaced with that has been written in the past ten years or so that hasn't used JWTs.