And then when the user comes back the next day with the token, you know that user is still logged in to your system.Īfter a week, the token will be expired and the user will not be authorized and will have to sign in again to get a new token. That way, you can create a token with an expiration of, let's say, 1 week. So, when you receive a token that you emitted, you can verify that you actually emitted it.

It is not encrypted, so, anyone could recover the information from the contents.īut it's signed.