Sign in Get started

Decision guide

Sessions vs JWT vs Opaque Tokens for Mobile Apps

What kind of credentials should a mobile app hold?

Side by side

CriterionServer session tokenJWT access + rotating refresh tokenOpaque access token + introspection
ValidationSession store lookupLocal signature + claims checkIntrospection call (cacheable)
RevocationImmediateRefresh revoked now; access token valid until expiryImmediate
Works across many servicesNeeds shared store or gatewayYesYes (via introspection)
Token sizeSmallLargeSmall
Theft impactUntil session revoked≤ access TTL; refresh reuse detectionUntil revoked
Storage on deviceKeychain / KeystoreKeychain / KeystoreKeychain / Keystore
StandardsCustomOAuth 2.1, RFC 9068, RFC 8252OAuth 2.0, RFC 7662

When to choose each

Server session token

Random session ID stored server-side; app sends it as a bearer header.

Choose when

  • First-party apps with one backend
  • Need for instant revocation and simple ops

Avoid when

  • Many independent APIs/microservices validating tokens

JWT access + rotating refresh token

Short-lived signed access token (5–15 min) plus a rotating opaque refresh token.

Choose when

  • OAuth/OIDC with an identity provider
  • Multiple APIs validating tokens locally
  • Third-party or multi-app ecosystems

Avoid when

  • Teams unwilling to manage key rotation and short TTLs

Opaque access token + introspection

Random access token validated by calling the authorization server (cached).

Choose when

  • Sensitive APIs needing immediate revocation
  • Hiding token contents from clients

Avoid when

  • Very high-throughput APIs without introspection caching

Verdict

For first-party apps with one backend, server sessions (long-lived, revocable, stored in Keychain/Keystore) are simple and secure. When you use an identity provider or many APIs, use OAuth code + PKCE with short JWT access tokens and rotating refresh tokens. Choose opaque + introspection when instant revocation matters more than latency. Whatever you pick: never embed client secrets, use the system browser for third-party login, and support remote logout per device.

Learn more

Sources