JWT (JSON Web Token)

A JWT (JSON Web Token) is a compact, URL-safe token for securely passing claims between two parties, commonly used for authentication in web APIs. After logging in, the server issues a JWT, and the client sends it with later requests, usually in the Authorization header.

A JWT has three Base64URL-encoded parts separated by dots: a header (the signing algorithm), a payload (claims such as the user ID and expiry time) and a signature that proves the token has not been changed. The payload is only encoded, not encrypted, so it must not contain secrets.

xxxxx.yyyyy.zzzzz
header.payload.signature

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...