JWT vs cookie authentication in ASP.NET Core 11: which should you pick?
Use cookie authentication for any app where the browser is the only client, and reserve JWT bearer tokens for APIs called by mobile apps, other services, or third parties. Here is the full decision matrix.