JWT
What is a JWT?
A compact, URL-safe token format for carrying claims between parties. JWT is a format, not an authentication protocol by itself.
What are its parts?
A signed JWT commonly has header.payload.signature. The header describes the token and algorithm; the payload contains claims; the signature helps verify integrity.
Is the payload secret?
Usually not. A signed JWT is typically readable by anyone who has it. Do not put passwords or secrets in its payload.
How is it sent?
A common pattern is the HTTP header Authorization: Bearer <token>. The API must validate the token before trusting it.
What should be validated?
Verify the signature with an explicitly allowed algorithm, and validate relevant claims such as issuer, audience and expiry.
How does Keycloak relate?
Keycloak can issue access and ID tokens. APIs should validate access tokens intended for them; ID tokens are primarily for the client.
Related: Browse all topics