Session Token
An opaque identifier stored in a cookie that points to session state kept on the server — the alternative to a self-contained JWT session, revocable by deleting one database row.
aka: server-side session
The trade-off with JWT-as-session is exact and opposite: an opaque session token needs a server-side lookup on every request but revokes instantly and cleanly, while a JWT skips the lookup but keeps working until it expires unless the server maintains a denylist. Which one fits depends on whether instant revocation or stateless scaling matters more for a given system.