What is the difference between JWT and opaque tokens in a microservices context?
Compare JWT and opaque tokens in microservices: self-contained claims vs introspection, revocation, performance trade-offs, and hybrid token strategies.
Expected Interview Answer
A JWT is a self-contained token that carries the user's claims (identity, roles, expiry) inside a signed payload, so any service can validate and read it without a network call, whereas an opaque token is just a random reference string that carries no data and must be validated by calling the authorization server's introspection endpoint.
JWTs are stateless and fast: a service verifies the signature with a public key and immediately trusts the embedded claims, which suits high-scale microservices. The trade-off is that JWTs are hard to revoke before expiry and expose their contents (base64, not encrypted). Opaque tokens keep all state on the auth server, so they are trivial to revoke instantly and leak nothing, but every validation requires a round trip to the introspection endpoint, adding latency and coupling. A common hybrid uses opaque tokens externally and JWTs internally after the gateway introspects once.
- JWT: stateless, self-validating, no lookup per request
- JWT: scales well across many independent services
- Opaque: instant revocation by deleting server-side state
- Opaque: leaks no claims, contents are meaningless if stolen
- Hybrid: opaque at the edge, JWT internally for speed
AI Mentor Explanation
A JWT is like a printed player pass that already lists your name, team, and access zones right on the card — any gate steward reads it and lets you through without phoning anyone. An opaque token is a plain numbered token you hand over, and the steward must radio the central office to ask what that number is allowed to do before admitting you.
Step-by-Step Explanation
Step 1
Understand JWT structure
A JWT has header, payload (claims), and signature; the payload is base64-encoded, readable, and signature-verified.
Step 2
Understand opaque tokens
An opaque token is a random reference string with no readable content; all data stays on the auth server.
Step 3
Validate a JWT
A service checks the signature with the issuer's public key and reads claims locally — no network call needed.
Step 4
Validate an opaque token
A service calls the auth server's introspection endpoint (RFC 7662) to learn if the token is active and its claims.
Step 5
Choose per use case
Use JWT for stateless scale; opaque for instant revocation; hybrid to combine edge revocation with internal speed.
What Interviewer Expects
- JWT is self-contained; opaque is a reference requiring introspection
- JWT trades revocation difficulty for stateless performance
- Opaque trades a network round trip for instant revocation and no leakage
- Awareness that JWT payloads are encoded, not encrypted
- Knowledge of the introspection endpoint (RFC 7662) and hybrid patterns
Common Mistakes
- Thinking a JWT is encrypted rather than just signed and base64-encoded
- Assuming JWTs can be revoked instantly like opaque tokens
- Putting sensitive data inside JWT claims
- Introspecting an opaque token on every internal hop, adding latency
- Using very long JWT lifetimes, widening the window for stolen tokens
Best Answer (HR Friendly)
“A JWT is like an ID card that already contains all your details, so any checker can read it directly. An opaque token is just a claim ticket with a number that means nothing until the issuer looks it up. JWTs are faster and scale well; opaque tokens are easier to cancel instantly.”
Code Example
// JWT: validated locally, no network call
import jwt from 'jsonwebtoken'
const claims = jwt.verify(jwtToken, PUBLIC_KEY, { algorithms: ['RS256'] })
console.log(claims.sub, claims.roles) // read directly
// Opaque token: must ask the auth server (RFC 7662)
async function introspect(token) {
const res = await fetch('https://auth.example.com/introspect', {
method: 'POST',
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({ token, client_id: ID, client_secret: SECRET }),
})
const data = await res.json()
return data.active ? data : null // { active, sub, scope, exp }
}Follow-up Questions
- How would you revoke a JWT before it expires?
- What is the token introspection endpoint in OAuth2?
- Why is a JWT payload encoded but not encrypted?
- When would you choose a hybrid opaque-external, JWT-internal design?
- How do refresh tokens fit into JWT-based auth?
MCQ Practice
1. What must a service do to validate an opaque token?
An opaque token carries no data, so the service must call the introspection endpoint to learn if it is active and its claims.
2. Which is a key drawback of JWTs?
Because JWTs are self-contained and stateless, they remain valid until expiry and are difficult to revoke early.
3. How is a JWT payload protected?
A standard JWT payload is base64-encoded and signature-verified, so it is readable — sensitive data should not be placed in it.
Flash Cards
JWT — Self-contained signed token carrying claims; validated locally, hard to revoke early.
Opaque token — Random reference string with no data; validated via the auth server's introspection endpoint.
JWT payload security — Signed and base64-encoded, not encrypted — do not store secrets in it.
Hybrid pattern — Opaque token at the edge for revocation, JWT internally for stateless speed.