Session: Server remembers the user
JWT: Client carries signed token
OAuth 2.0: Limited third-party access
API Key: Service/application access
What you will learn
By the end, you will know which method to use in real projects.
Stateful vs Stateless
Sessions vs JWT
OAuth 2.0 and OIDC
API Keys for services
1. Session Authentication: Server remembers the logged-in user
In session authentication, the user logs in and the server creates a session. The session is stored in Redis, database, file storage, or memory. The browser receives only a session ID, usually in a cookie.
User Login → Server Creates Session → Stores in Redis/DB → Browser Receives Cookie → Every Request Sends Cookie
Best for
Traditional websites
Laravel/Django apps
Admin panels and banking apps
Limitations
Needs shared session storage
Harder to scale across many servers
2. JWT: Client carries a signed identity token
JWT stands for JSON Web Token. After login, the server signs a token and sends it to the client. The client sends this token with every API request.
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR...
The server usually does not store session data. It verifies the token signature and reads the claims. This makes JWT mostly stateless.
Best for
REST APIs
Mobile apps
React/Vue/Angular frontends
Microservices
Be careful
JWT payload is encoded, not encrypted
Revocation before expiry is harder
3. OAuth 2.0: Limited permission without sharing passwords
OAuth 2.0 is an authorization framework. It allows a third-party app to access limited user data without knowing the user's password.
User → Login with Google → Approves Permissions → App Receives Access Token
Important: OAuth 2.0 is for authorization. For login and identity, it is usually used with OpenID Connect.
4. API Keys: Simple access key for applications and services
API keys are long secret keys used to identify an application, service, or developer account. They are simple and useful for server-to-server communication.
x-api-key: sk_live_xxxxxxxxx
Best for
Internal APIs
Developer SDKs
Webhooks
Service-to-service calls
Limitations
No user identity by default
Leaked keys are risky
Expiry must be implemented
Core Concept
Stateful vs Stateless
Stateful
The server remembers the client. Sessions are stateful because the server stores session data.
Cookie → Server → Redis/DB → User Found
Stateless
The server remembers nothing between requests. Every request must prove identity.
JWT → Verify Signature → Read Claims → Allow
Quick Comparison
Feature | Session | JWT | OAuth 2.0 | API Key |
|---|---|---|---|---|
Main Purpose | User login | API/user auth | Delegated access | Service access |
State | Stateful | Stateless | Mixed | Usually stateless |
User Identity | Yes | Yes | With OIDC | No by default |
Best For | Web apps | APIs/mobile | Third-party login | Server-to-server |
Complexity | Low | Medium | High | Low |
Which one should you use?
Laravel WebsiteSession Authentication
React + APIJWT
Mobile AppJWT
Google LoginOAuth 2.0 + OIDC
Internal APIAPI Key or JWT
Public APIOAuth 2.0 or API Key
Final Summary
Session means the server remembers the user.
JWT means the client carries a signed token.
OAuth 2.0 means delegated permission to access another service.
API Key means a service proves it is allowed to call an API.
Real systems often combine these methods. For example, an app may use sessions for the admin panel, JWT for mobile APIs, OAuth 2.0 for Google login, and API keys for internal services.
