JWT with OAuth 2.0 is pretty awesome. You can validate the JWT is legit even before hitting the database with a user lookup

do you have an example on github? (in kotlin or even with ktor?)

I don’t use either. But here’s a talk that discusses API security including OAuth 2.0 with JWT for the access tokens

Works fine with spring boot or vert.x with Kotlin...and yes, it's the standard. All new apps should use it...

The trick here is that, like X-B3 request tracing headers, encrypted JWT tokens can be passed from service to service transparently without messing up your APIs - you need a way of making that "request context" available to both incoming middleware and outgoing http clients.