When do you use session authentication versus bearer tokens in Spring?

I choose from client trust, single sign-on, cross-origin topology, revocation latency, token audience, and incident response. Long-lived self-contained access tokens reduce authorization-server calls. They also extend stale permissions and theft impact, so access tokens stay short-lived and refresh behavior is bounded and rotated where appropriate. Logs never contain credentials, caches vary on identity correctly, and downstream calls receive only a token intended for that audience rather than blindly forwarding the user's token.