- token can be obtained through username / password
- with token in headers, you can access the restricted API
- you can create a token with expiration time
- you can verify whether token is valid or expired
- can invalidate the specified token
read Jwt
, but it seems that you can"t take the initiative to invalidate token
.