JWS

JSON Web Signature (JWS), standardized as RFC 7515, defines how to represent content that has been digitally signed or MACed using JSON-based data structures. It is a foundational member of the JOSE family, and it is the mechanism that gives a token or message a verifiable claim to integrity and origin. When you verify a signed JWT, you are verifying a JWS.

• Signed, verifiable content - Protects an arbitrary payload with a signature or MAC so a recipient can confirm it was not altered in transit.
• Compact and JSON serializations - Offers a compact, URL-safe header.payload.signature form for tokens and a fuller JSON form for more complex, multi-signature use cases.
• Algorithm agility - The protected header names the algorithm (alg) and, often, the key (kid), so signers and verifiers agree on exactly how integrity was established.
• Key discovery via JWK - Verification keys are typically published as a JWK Set, letting a service rotate keys without breaking existing tokens.

In real API operations, JWS is the integrity layer beneath modern token security. It is what makes a JWT tamper-evident, what secures OpenID Connect ID tokens, and what underpins signed webhooks and message payloads where a consumer must trust that content came from the stated issuer. As more machine-to-machine and agentic traffic flows without a human checking anything by hand, JWS is the standard that lets each party prove a message is authentic before acting on it.