JSON Web Token (JWT)

JSON Web Token (JWT), standardized as RFC 7519, is a compact, URL-safe way to represent a set of claims securely between two parties. A token is three base64url-encoded segments — header, payload, and signature — joined by dots, so it travels comfortably in an HTTP header or query string. It is one of the most widely deployed security standards in the API economy, and for good reason: it packs identity and authorization state into a single self-describing string.

• Claims-based payload - Carries standard claims like iss, sub, aud, and exp alongside any custom claims an application needs.
• Signed for integrity - Wrapped as a JWS so a recipient can verify the token was issued by the stated party and has not been altered.
• Stateless and self-contained - The token itself carries the claims, so a resource server can validate a request without a database lookup or session store.
• Key verification via JWK - Signing keys are commonly published as a JWK Set, letting issuers rotate keys without breaking clients.

In real API operations, JWT is the workhorse of bearer-token authentication and authorization. It is the access-token and ID-token format behind most OAuth 2.0 and OpenID Connect deployments, letting a gateway or microservice check a caller’s identity and scopes locally on every request. As agentic clients proliferate, JWT is often the credential an autonomous agent presents — which is exactly why short lifetimes, audience restriction, and honest signature verification matter more than ever.