A handwritten note claiming to be from the king could have been written by anyone; a letter sealed with the king's own signet ring can be verified by anyone who recognizes the seal, without ever needing to ask the king directly. A JWT plays the same role for an API request — the server checks the signature against a secret it already holds, instead of looking the caller up in a database on every single call.
None of my Laravel or Node work has needed to reinvent this mechanism from scratch — Sanctum and equivalent middleware handle it — but the underlying question has come up wherever I've had a client talking to a stateless API that shouldn't need a database hit just to confirm who's asking: the Node.js/Express backends I built for ViveLab's blockchain voting and land-registry prototypes, and the third-party integrations at Infracommerce. In each case, the same distinction mattered — can the server verify this request on its own, or does it need to ask the database 'have I seen this before?' every time.
Trade-off: a JWT can't be revoked before it expires without keeping some kind of blocklist — which reintroduces the very database check the token was supposed to let you skip on every request.
Before
class OrderController
{
public function index(Request $request): JsonResponse
{
$userId = $request->header('X-User-Id');
// nothing stops a caller from sending any value here
return response()->json(
Order::where('user_id', $userId)->get()
);
}
}After
class OrderController
{
public function index(Request $request): JsonResponse
{
$token = JwtToken::verify($request->bearerToken());
// signature checked against a shared secret, no DB lookup
return response()->json(
Order::where('user_id', $token->claim('sub'))->get()
);
}
}