Comment by ivanhoe

IMHO rule of the thumb is: If you can get away with simple random tokens, use that. If you can't (high-traffic distributed apps, microservices, serverless, etc.) JWT is probably the next easiest solution.