how jwt token works in web api?
['The user/client app sends a sign in request. ... ', 'Once verified, the API will create a JSON Web Token (more on this in a bit) and sign it using a secret key.', 'Then the API will return that token back to the client application.']