As with most things, this depends on your use case. In API's JWT is the probably a better choice. In a front end server side application sessions are probably the right path. That being said, there are use cases where you need to use JWT instead of sessions and visa versa. There is no one way with this.