Should I use the JWT token in the OAuth2 for Delivering a Secure API

Question

I am developing the web application using ReactJS(Front-end UI) and Scala(Back-end API). I have implemented the backend services as microservices.

Here I have integrated OAuth2 authorization framework and used OAuth Access Tokens. After user authentication, I am passing the OAuth access tokens in every sub sequent request headers.

I did see in some website links, we should use JWT token in the OAuth2 flow instead of "OAuth access tokens" to delivering a Secure API.

Should I integrate JWT token in the existing OAuth2? Please share your suggestions. Thanks.

Answer 1

OAuth2 ia an authorization protocol and does not dictate the format of the access_token so you could return a JWT from the authorization server containing the scope/permissions and the expiration.

Would recommend to go through this https://auth0.com/blog/ten-things-you-should-know-about-tokens-and-cookies/#token-oauth