[gunshowmo]

I do sessions-based authentication via my API server. You can implement this in quite a few ways, but I think Redis is pretty common for the speed. I think there are libraries in most languages that should implement this in some way or another, but it isn't too hard to do by yourself either.

JWT also works very well if you don't need the ability to immediately revoke access, since in an efficient JWT implementation, you'd only be refreshing the token at specific intervals.

I also have a couple of flows set up to authenticate users via the Facebook and Google OAuth APIs, tying them to my own users' accounts.

[atmosx]

Dont start with JWT. It’s better to start with a traditional system and move to more complex/novel solution as the system grows.