> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/online-courses/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/online-courses/api-authentication/tokens/json-web-token.md).

# JSON Web Token

* JWT is a format
* It can be used for many purposes
  * ID Tokens are **always** JWTs
  * Access tokens **can** be JWTs
  * Refresh Tokens are **"never"** JWTs
* Most often signed (JWS)
* Can be encrypted (JWE)

<figure><img src="/files/KDJbIMDR164VPiQhofRL" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/lRJNJL89JMyh0Dzc3A10" alt=""><figcaption></figcaption></figure>

## Signed - JWS

* Proves who issued the token
* The prominent way for JWTs
* Asymmetric signatures
* Always whitelist algorithms allowed
* Don't rely on signature verify contents as well
  * Audience
  * Issuer
  * Expiration

## Encrypted - JWE

* Keeps data confidential
* Used in OpenID Connect
* ID Tokens
* User info responses
* Not practical for access tokens
* Opaque tokens are preferred to keep confidentiality

## JWTs and Protocols

A JWT **is not a protocol**.

They can be used in different ways depending on protocols

They should **not be used** against the **protocol's intention**.

## Example

* Access tokens are for the API
* They are issued to the client
* The client **should bot decode** the access token

<figure><img src="/files/Aq6Wwu7m2mICsbhwlhUi" alt=""><figcaption></figcaption></figure>