JSON Web Token (JWT) : Authorization vs Authentication : <p>JWT terminology has been bothering me for few reasons. Is JWT suitable for Authorization or is it only  for Authentication?</p>

<p>Correct me if I'm wrong but I have always read Authorization as being the act of allowing someone access to a resource yet JWT doesn't seem to have any implementation that actually allows access to users to a given resource. All JWT implementations talk about is providing a user a token . This token is then passed with every call to a back-end service endpoint where it is checked for validity and if valid access is granted. So we can use JWT for <strong>Authentication</strong> of any user  but how can we restrict the access to particular valid users ?</p>

<p>How can we use JWT for restricting few users depending on roles they have ?
Do JWT provide any type Authorization details as well or it just provide us Authetication ?</p>

<p>Thanks in advance for your help and reading my doubt patiently.</p>
