Which best describes JWT in REST API security?

JSON Web Tokens (JWTs) are primarily used for authentication in REST APIs. When a user successfully logs in, the server generates a JWT and sends it to the client. The client then includes this token in subsequent requests to access protected resources. The server verifies the token's signature to ensure its integrity and authenticity. JWTs are encoded, not encrypted, meaning their contents can be read but not easily tampered with without invalidating the signature. While JWTs can carry authorization information (like user roles), their fundamental role in this context is to verify the identity of the client (authentication). Therefore, "An encoded JSON token used for authentication" is the most accurate description.