JSON Web Token (JWT), explained
A signed JWT has three Base64URL-encoded parts separated by dots: a header naming the algorithm, a payload of claims, and a signature computed over the first two.
// header.payload.signature
{ "alg": "RS256", "typ": "JWT", "kid": "key-2026-01" }
{ "iss": "https://auth.example.com", "sub": "user_42",
"aud": "api.example.com", "exp": 1767225600, "scope": "invoices:read" }Registered claims include iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before) and iat (issued at). Because the signature can be checked with a shared secret (HS256) or a public key (RS256, ES256), an API can validate a JWT locally without calling the issuer on every request.
A signed JWT is encoded, not encrypted: anyone holding it can read the payload, so never put secrets in it. Servers must pin the accepted algorithms (never accept alg: none), verify the signature, issuer, audience and expiry, and fetch keys from a trusted JWKS endpoint. Because JWTs are hard to revoke before they expire, keep lifetimes short and pair them with refresh tokens from OAuth 2.0.
Related terms
- OAuth 2.0: OAuth 2.0 (RFC 6749) is an authorization framework that lets an app get limited, revocable access to an API on a user's behalf without their password.
- API key: An API key is a secret string a client sends with each API request to identify its application or account for authentication, quotas and billing.
- API security: API security is the practice of protecting APIs from misuse and attack with authentication, authorization, input validation, rate limits and monitoring.