What is a JWT?

JWT, or JSON Web Token, is a compact token format containing encoded claims and protected by a digital signature or message authentication mechanism. JWTs are commonly used as access tokens, although OAuth does not require access tokens to be JWTs.

A JWT payload is encoded, not inherently encrypted. Sensitive secrets should not be placed in readable token claims, and APIs must validate signature, issuer, audience, lifetime, and other required properties.