JWT stands for JSON Web Token. After login, Central Command issues a token that authorizes subsequent API calls. The application verifies the signature and validity without asking for the password again on every request. This is standard for modern web APIs and separates authentication from domain calls.
In the backend, the client typically stores the token in the session and sends it as a bearer header. If the session expires or the token is invalid, a new sign-in follows. JWT does not replace Basic Auth on the proxy, nor does it replace the careful management of API keys for Lexware or Clockify.
Security depends on the secret, the expiry time, and transport encryption. Tokens should never end up in public channels. For Central Command, JWT is the app's user authentication layer: visible as the login flow, invisible as the protection behind every dashboard and settings request.
