When delegated access from a user to a third-party service is needed, along with a clear separation of client/resource roles and standard flows (authorization code, client credentials).

Storing the token in localStorage without protection, lack of rotation/revocation, an overly long lifetime, and missing audience/issuer validation.

Always use HTTPS, restrict CORS, validate input data, implement rate limiting and brute-force protection, and log anomalies.

A more compact binary protocol, a strict contract-based API via Protobuf, bidirectional streaming, and better performance for internal services.

For public APIs, integrations with external teams and browsers, when simplicity and compatibility with HTTP tools matter.