@ordnungswidrig is this still valid regarding auth in Liberator? https://stackoverflow.com/a/14187220/791795 I would like to use JWT.

Yes, that's still fine. Simply implement authentication and authorization in :authorized. Have done that with JWT before and it worked. :-)

great thank, going to proceed like that then.

How can I coerce database UUIDs to strings when a resource is being requested as JSON? (but not otherwise)

I've come up with a very wonky function that check (get-in ctx [:representation :media-type]) and walks the resource data structure, converting UUIDs whenever found. But I wish Clojure JSON libs had support for the #uuid type 😕

IMO there's a clear >90% case, just like how they deal with keywords: make it a string

You can specify a custom :as-response function that checks if the media type is JSON and creates a string with whatever JSON lib you want. For all other cases delegate to liberator's stock as-response implementation. See @pandeiro 's answer on where the media-type is in the context.