JWE

JSON Web Encryption (JWE), standardized as RFC 7516, defines how to represent encrypted content using JSON-based data structures. It is part of the JOSE (JSON Object Signing and Encryption) family alongside JWS, JWK, and JWA, and it provides confidentiality — not merely integrity — for tokens and arbitrary payloads.

• Confidentiality, not just signing - Where JWS only signs a payload, JWE encrypts it so the contents stay private.
• JOSE family member - Works with JWK keys and JWA algorithms as part of the suite that underpins the JSON Web Token.
• Two serializations - A compact dot-delimited form for headers and URLs, and a JSON form for richer structures.
• Layered with JWS - A payload can be signed and then encrypted, or the reverse, to get both integrity and confidentiality.

In API operations JWE is what you reach for when a token or message body must be hidden from intermediaries, not merely tamper-evident — encrypted JWTs carrying sensitive claims, or protected payloads passed between services. Because it is more complex and more fragile than plain signing, encrypted-token use tends to appear in higher-assurance and regulated environments, and its correct configuration — algorithms, key management, rotation — is exactly the kind of detail API governance has to verify rather than assume.