<![CDATA[Representational State Transfer (REST) is widely adopted for web-based client–server communication, but its stateless design requires additional mechanisms to ensure authentication, authorization, and message integrity. JSON Web Token (JWT) addresses these requirements by embedding digitally signed claims that can be verified by REST-API services. This study compares the performance of two asymmetric JWT signing algorithms, RS-256 and ES-256, to determine their suitability for REST-API security under different deployment environments. A comparative experimental approach was applied by implementing both algorithms in a REST-API application and testing token generation and token verification processes on a cloud virtual machine and a physical machine. Apache JMeter was used to conduct scalability testing with 100 to 1,000 request samples. Four performance metrics were evaluated: response time, throughput, CPU usage, and memory usage. The results show that ES-256 consistently outperformed RS-256 in token generation across both environments, with better response time, throughput, CPU efficiency, and memory consumption. During token verification, ES-256 achieved better response time and throughput, while RS-256 showed lower CPU and memory usage. These findings indicate that ES-256 is generally more suitable for REST-API systems prioritizing fast token generation and high throughput, whereas RS-256 remains relevant when verification efficiency in computational resource usage is the primary concern. The study provides guidance for selecting JWT signing algorithms in scalable API security implementations and distributed services.]]>
