JSON Web Token (JWT): should I use response header or body for token transportation?

I'm developing a RESTful web service that issues access tokens in the form of JSON Web Tokens (JWT), so that clients can use them for further authorization. Currently, I store tokens in a response body, but typically it's advised to add it to Authorization header. Why should I choose header and not response body? Is there any principal advantage on using one method over the other?

@RestController
@RequestMapping(path = "/auth", produces = "application/json")
public class AccessTokenController {

    @Value("${jwt.secret.key.gen}")
    private String secretKey;

    @Value("${jwt.expiration.days}")
    private int expirationDays;

    private final UsersRepository usersRepository;
    private final PasswordEncoder passwordEncoder;

    @Autowired
    public AccessTokenController(UsersRepository usersRepository, PasswordEncoder passwordEncoder) {
        this.usersRepository = usersRepository;
        this.passwordEncoder = passwordEncoder;
    }

    @PostMapping(value = "/access-token", consumes = "application/json")
    ResponseEntity<Object> getAccessToken(@RequestBody Map<String, String> credentials) {

        // #1: check request body for username and password
        String username = credentials.get("username");
        String password = credentials.get("password");
        if (username.isBlank() || password.isBlank())
            throw new IllegalArgumentException();

        // #2: check database for given username and password
        User user = usersRepository.findByUsername(username)
                .filter(u -> passwordEncoder.matches(password, u.getPassword()))
                .orElseThrow(() -> new BadCredentialsException("No such user with given password"));

        // #3: check 'enabled' status for the requested user
        if (!user.isEnabled())
            throw new DisabledException("User is currently disabled");

        // # 4: create and return access-token (finally!)
        String token = Jwts.builder()
                .setSubject(username)
                .setExpiration(new Date(System.currentTimeMillis() + expirationDays * 24 * 60 * 60 * 1000))
                .signWith(SignatureAlgorithm.HS512, secretKey.getBytes())
                .compact();
        return new ResponseEntity<>(Collections.singletonMap("access-token", token),
                HttpStatus.OK);
    }

    @ExceptionHandler({JsonParseException.class, NullPointerException.class, IllegalArgumentException.class})
    @ResponseStatus(HttpStatus.BAD_REQUEST)
    public Map<String, String> handleWrongOrMissingCredentials() {
        return Collections.singletonMap("error", "Wrong or missing credentials");
    }

    @ExceptionHandler(AuthenticationException.class)
    @ResponseStatus(HttpStatus.UNAUTHORIZED)
    public Map<String, String> handleAuthenticationException(AuthenticationException ex) {
        return Collections.singletonMap("error", ex.getMessage());
    }

}

It is part of the HTTP standard which all api follow. In basic terms think of a set of rules that everyone follows so that when people develop servers or clients then they can follow this set of rules to avoid discrepancies

RFC https://www.rfc-editor.org/rfc/rfc7235#section-4.2

> The "Authorization" header field allows a user agent to authenticate
> itself with an origin server -- usually, but not necessarily, after
> receiving a 401 (Unauthorized) response. Its value consists of
> credentials containing the authentication information of the user
> agent for the realm of the resource being requested.
>
> Authorization = credentials

There are many different types of authorization headers that people can use right now and once you use it then you know what to expect. Here is a simple list to show a few

       •	Basic Auth
•	Bearer Token
•	API Key
•	Digest Auth
•	Oauth 2.0
•	Hawk Authentication
•	AWS Signature