Use OAuth2 or JWT for mobile application with Wordpress backend (REST API)

Question

So.. I've read countless articles, but still can't wrap my mind on which to use; if a simple JSON Web Token is enough..

I have a Wordpress website and a mobile application of said website.
I can login in my website using email and password and I can also login on my mobile application using email and password.
The mobile application communicates with the website through the Wordpress REST API. It (the mobile app) sends the user email and password to the API, and the API returns a JWT if both are valid.
Then, I simply store the JWT in the user's device.

My main doubts are:
For a mobile app with not much sensitive user data, is that acceptable/safe enough?
For a mobile app with sensitive user data, is that acceptable/safe enough?

Or should I use OAuth2 in both cases (which is harder to implement and will take time, but it's safer (I think..))?
Thank you and apologies if duplicated.

Answer 1

This is more of a security compliance decision you might have to take.

As a first thing, you should think like a product owner or ask a product owner about which one to use by explaining to them, what are the advantages of OAuth 2.0 over simple JWT.

You might have to consider the following things,

1. what is the size of the userbase?
2. how sensitive is the data you are going to store?
3. What is the user experience you wanted to give to your users?

Also, JWT doesn't mean it is not safe enough.

One more extra thing you could do to make it more secure is adding a expiry time for your JWT with a refresh token mechanism that way even if JWT is exposed it ll be expired later sometime.