Question: how jwt token works in web api?
Answer: The user/client app sends a sign in request. ... 
Once verified, the API will create a JSON Web Token (more on this in a bit) and sign it using a secret key.
Then the API will return that token back to the client application.