Sessions vs tokens

Classic auth used server-side sessions. The server stored who you were and gave you a cookie pointing at that session. Modern stacks use tokens instead: the server signs a string containing your identity, you carry it with every request, and no server-side state is needed. Tokens are stateless, which matters for horizontally scaled services.

Stateless means any server instance can handle any request without looking up session state. That is why every modern API uses JWTs or similar. You pay for it in other ways: revocation is harder, expiration matters more, and you have to store the token somewhere safe on the client.