Hey
There is a hex called Guardian that pretty much takes care of all the stuff you mentioned in terms of JWT. I have a web application with very similar requirements. I think JWT was a great choice for me since it works for all scenarios. I have one api that multiple interfaces connect to.
For my case I have multiple React apps that connect to the api and if I want I can use the same api for mobile apps or any other clients for that matter.
