JWT
Also called: JSON Web Token
JSON Web Token: a signed token with three base64url parts (header, payload, signature) that APIs use to identify the caller.
Definition
A JWT carries claims such as the user id (sub), the role and the expiry time (exp). The header and payload are only encoded, not encrypted, so anyone holding the token can decode and read them. Only the server can verify the signature, so decoding a token proves nothing about whether it's genuine.
In practice
Decoding Anna's token shows "sub": "u_1001", "role": "customer" and an exp 50 minutes from now. Changing the role to admin breaks the signature, and the API must answer 401.
Learn it in context
Lessons that use this term.