Auth System Problems with JWT & OAuth 2.0 at Scale — How GNAP Solves Them

Most modern auth systems eventually hit the same two failure modes. Problem 1 – JWT-based auth systems JWT looks perfect on paper: stateless, self-contained, fast verification. In real production auth systems, the moment you need instant revocation, logout, permission changes, or response to token theft, the model breaks. You are forced to introduce a denylist (Redis or database). That destroys the original “stateless” benefit and adds a lookup on every request. Signature malleability and JWKS cache-miss flooding create additional operational and security risks. This is one of the most common pain points in high-scale authentication systems today. Problem 2 – OAuth 2.0 opaque-token auth systems OAuth 2.0 gives real-time revocation through token introspection. The cost is severe: every protected API request now pays an extra network round-trip to the authorization server. At low traffic this is invisible. At high throughput the introspection endpoint becomes a shared bottleneck, connection pools saturate, and the p99 latency of the entire auth system tracks the auth server’s latency. The classic front-channel redirect flow also creates friction for native apps, CLIs, desktop tools, and autonomous agents. These two patterns cover the majority of production auth systems currently in use — and both break under different kinds of load. Solution – GNAP (Grant Negotiation and Authorization Protocol, RFC 9635) GNAP redesigns the authorization model around asymmetric key-bound tokens. The client proves possession of a private key (typically Ed25519) on every request using HTTP Message Signatures. Resource servers verify the signature locally in tens of microseconds with zero database queries and zero network calls for the token itself. Tokens remain manageable and revocable when needed, but the common path stays extremely cheap and truly local. Interaction can happen entirely on the back channel, removing the browser-redirect requirement for many non-web clients. I recorded