Question: how json web tokens work?
Answer: The application or client requests authorization to the authorization server. ... 
When the authorization is granted, the authorization server returns an access token to the application.
The application uses the access token to access a protected resource (like an API).