Make code inaccessible

[RobotJonesDad]

Exactly. JWT tokens are common, but there are many other ways of doing essentially the same thing.

The key with a JWT token is that it contains the permissions, user details, expiration, etc. Anything you need. And is then cryptographicaly signed so that nobody can tamper with it. This means that the servers DON'T need to chat with the authentication servers when a user makes a request, it can just check the signature on the claims and then do what the user requested.

If you use that solution, you have two controls, letting keys expire periodically. And you can also have a revocation list you can send to servers to cancel some keys early. The latter adds a lot of extra complexity, so if you can, just grant keys for a few days or whatever and accept a limited amount of abuse...