Guide

JWT in OAuth 2.0 & OpenID Connect

How JWT is used in OAuth 2.0 and OpenID Connect.

Access token: represents permission to access a resource (API). Often a JWT, but its format is not mandated.
ID token (OIDC): a JWT that carries the authentication result; it must be a JWT and includes sub, aud, iss, exp and profile claims.
Refresh token: used to renew the access token; usually an opaque string, so it's not meant to be decoded.
When verifying, always check iss, aud, exp and the signature; OIDC verifies the signature with the issuer's JWKS (public keys).

Try decoding a token yourselfJust paste and the header, payload and claims unfold instantly.

Open the decoder

Related

A JWT (JSON Web Token) is a small, signed JSON token format for securely passing information between parties.

The three-part JWT structure

Every JWT consists of header.payload.signature, and each part is base64url encoded.

JWT security checklist

A short checklist of the key principles for using JWT safely.

JWT vs session authentication

The difference between token (JWT) auth and server session (cookie) auth, and when to use each.

Common JWT errors and fixes

The errors you meet most often when working with JWT, with their causes and fixes.

Access tokens and refresh tokens

The role of the short-lived access token and the refresh token that renews it.

JWS vs JWE (signed vs encrypted)

A JWT is usually a signed JWS; to hide the content you use an encrypted JWE. Here is the difference.

Where to store a JWT: localStorage vs cookie

Where you store a JWT in the browser changes your XSS and CSRF risk.

Custom claims (public vs private)

Beyond registered claims (iss, exp, ...), the kinds of claims you define yourself and how to avoid collisions.