Use JWTs to carry trusted identity information across services without making every service handle login itself.
In a microservices architecture, a user request may travel through several independent services. JWTs can carry identity and authorization information so services can verify who is making a request without asking the authentication service every time.
This works well when services can independently verify tokens using a shared secret or public key. However, distributed authentication introduces challenges around key management, token expiration, service-to-service trust, revocation, and deciding which service is responsible for authorization.
What you'll walk away knowing