Authentication
Establishing who is calling: credentials, sessions, tokens, OAuth and API keys, from the backend's side of the problem rather than the protocol's.
Turning an untrusted credential into an authenticated principal, once, early, in one place — and nothing more than that.
Store passwords with a slow, salted, purpose-built hash from a maintained library. Everything else in this lesson is a consequence of that sentence.
The server keeps the state and the client carries an opaque handle. Revocation is a delete; the cost is a lookup on every request.
Process memory, a database table, a shared cache or a distributed store — four answers with different scale ceilings and different things that happen when they fail.
A self-contained token removes the lookup by carrying its own claims — and removing the lookup is exactly what makes immediate revocation hard. That is the trade, and it is the whole lesson.
Three roles, two very different tokens, and one rule: use a maintained library, because the parts you would get wrong are the security parts.
A long-lived secret that identifies an application rather than a person — cheap to verify, easy to leak, and revocable only if you designed for it.