A JSON Web Token (JWT), pronounced “jot,” is a compact, URL-safe representation of a JSON object. It carries claims about a subject’s identity or right to access an API, and its signature helps prove that the token has not been altered. section 7.2 section 7.2.1
A JWT normally has three parts: a header containing metadata such as the signing algorithm, a payload containing claims, and a signature proving legitimacy. Claims can identify the issuer, subject, audience, issue time, expiry time, role, group, or access scope. section 7.8
An API access token
An access token might identify subject 23456543, state that https://auth.apithreats.com issued it for https://apithreats.com/api, record its issue time, and expire it one hour later. The client sends the resulting token in the Authorization request header when calling the API. section 7.8
Distinguish access tokens from ID tokens. OpenID Connect uses ID tokens to carry personal details about a human identity, while access tokens carry permission claims for an API. An ID token does not prove permission to perform an API operation and must not validate access. section 7.2.1
Use JWTs safely by treating the standard as a format, not a complete security system:
- Validate the signature correctly and reject expired tokens; otherwise attackers may tamper with tokens, hijack accounts, or escalate privileges. section 4.4
- Restrict accepted signing algorithms instead of allowing the token to choose an arbitrary or random algorithm. section 2.3.2 section 12.1
- Keep personal and sensitive information out of JWTs; claims should express the access decision without exposing unnecessary user data. section 2.3.2 section 7.2.1
- Prefer a standard identity-as-a-service provider; when issuing tokens yourself, use a self-hosted provider or a robust JWT library rather than custom cryptography. section 8.2
- Consider sender-constrained tokens when intercepted credentials could be replayed, using certificate binding or proof-of-possession mechanisms. section 4.4 section 7.8
Issuing a JWT with PyJWT
A Python implementation can create a payload with issuer, subject, audience, issued-at, and expiry claims, then call jwt.encode with a signing key and an explicitly selected algorithm such as HS256 or PS256. The resulting compact string is the token sent to the client.
JWTs are especially useful when designing focused security tests. If an API uses structured JWTs, test token tampering, algorithm confusion, missing credentials, expired tokens, and privilege escalation. If it uses opaque tokens instead, exclude JWT-specific tests and follow the actual threat model. section 12.1
