There are four ways modern applications generally authenticate ...

• outsource your authentication to an Oauth-like provider and hope they don't get compromised,

• keep a session per user (which is horrible for scaling unless your load balancer can send all the requests from that user to the same server),

• generating a token and keeping it in some sort of database and authenticating each request against that database (this is my preferred way of building authentication, all components can be built stateless without sessions and it scales well)

• and lastly building a complicated token that contains all the authentication details, it's the same as the previous one, except that the token is not stored in the database and your backend has to decrypt the token to validate if it's a valid token

The only problem I have the last way of authentication is that if somebody figures out how to re-create your tokens, they can log in with any any account whereas with the third way, you generate a secure-GUID which is completely random and unless you can match that random token, you can't login.