What are the security and architectural considerations of using stateless, token based authentication such as JWT instead of traditional server side sessions for an API?

Traditional server side sessions require the server to maintain some form of state about each authenticated user, which can complicate scaling an application across multiple servers without shared session storage, whereas a stateless token like a JWT contains all the necessary claims about the user directly within the token itself, cryptographically signed so the server can verify it has not been tampered with, without needing to look anything up in shared storage at all, though this approach introduces its own considerations, such as how to properly revoke a token before its natural expiration if a user's account is compromised.

$token = JWT::encode(['user_id' => 42, 'exp' => time() + 3600], $secretKey, 'HS256');