It is also important to ensure whatever solution you adopt, that it fits with your application. The level of security you need will depend on your risk assessment and the extent to which things need to be protected. There is nothing worse for the user than being required to go through too much security compared to the value of the service being offered.
I would also recommend using an existing, well tested and understood solution rather than trying to re-invent the wheel. There are a number of libraries for both servers and clients to handle this type of requirement. These are not guaranteed to be 100% secure (nothing ever is). For example, there has been recent posts regarding security issues with JWT libraries. However, the fact that these frameworks are being tested and examined for security weakensses means you will likely get a better end result than writing something yourself which is not getting that added attention.