Being able to create an anonymous access token, that in turn has certain restricted claims defined by default.

API keys kind of do the job, but they're basically deprecated through a lot of JWT providers, and you need to support two Auth systems if you're using JWT for logged in users.

Flow is:

* Arrive at website * Generate an access token without any user input (anon user with default read only privileges) * Use the same APIs as logged in users, with restricted access defined in the JWT / Auth provider.

The two sides of it, am I allowed to access this API, coupled with what can I do once accessed seem to be the basic use case for JWT.

I appreciate the response. My terminology is likely a bit off, it's been a while :)