Opaque token = random string, meaning only known to the auth server JWT token = self-contained token, meaning readable by anyone
🔹 What is an Opaque Token?
An opaque token is just a random string.
Example:
a8f9k2n9s8df7sdf98s7df98s7df
- Client cannot read anything from it
- Resource server cannot understand it by itself
- To validate it, server must call the Authorization Server (introspection)
How it works
- Client sends token to API
- API calls Auth Server: “Is this token valid?”
- Auth server responds with user details, expiry, scopes, etc.
Characteristics
| Property | Opaque Token |
|---|---|
| Human readable | ❌ No |
| Self-contained | ❌ No |
| Needs DB/Introspection | ✅ Yes |
| Revocation | ✅ Easy |
| Size | Small |
| Performance | Slower (network call) |
| Security | Very high (nothing exposed) |
🔹 What is a JWT Token?
JWT = JSON Web Token
Example (3 parts):
xxxxx.yyyyy.zzzzz
Decoded payload looks like:
{
"sub": "12345",
"name": "Sajid",
"role": "ADMIN",
"exp": 1735600000
}
- Anyone can decode it (Base64)
- No need to call auth server
- API can validate using public key / secret
How it works
- Client sends JWT to API
- API verifies signature
- API reads user info directly from token
Characteristics
| Property | JWT Token |
|---|---|
| Human readable | ✅ Yes |
| Self-contained | ✅ Yes |
| Needs DB/Introspection | ❌ No |
| Revocation | ❌ Hard |
| Size | Large |
| Performance | Fast |
| Security | Depends on design |
🔥 Key Architectural Difference
| Question | Opaque | JWT |
|---|---|---|
| Where is user data stored? | Auth server DB | Inside token |
| API dependency on auth server | High | None |
| Good for microservices? | ❌ No | ✅ Yes |
| Can revoke immediately? | ✅ Yes | ❌ No |
| Stateless API? | ❌ No | ✅ Yes |
🧠 When to Use What?
Use Opaque Token when:
- Banking / highly secure systems
- Need immediate token revocation
- Want full control from auth server
- Token data must be hidden
Use JWT when:
- Microservices architecture
- High performance APIs
- Stateless authentication
- Many services validating same token
⚠️ Real Problem with JWT (very important)
If JWT is valid for 1 hour and user is blocked now…
👉 JWT will still work for 1 hour (because no introspection)
This is the biggest drawback.
Solution in real systems:
- Short-lived JWT (5–10 min)
- Refresh token with auth server
- Or hybrid approach
🏆 What Big Companies Do?
They use:
JWT access token + Opaque refresh token
Best of both worlds.
One-line Summary
Opaque = “Trust the auth server” JWT = “Trust the token itself”