VersolaVersola/docs
versola.kzGitHub
RUEN

RFC 7519 — JSON Web Token

JWT structure and claims used for access tokens and ID tokens

Specification: RFC 7519

JSON Web Tokens (JWT) are used as the format for access tokens (RFC 9068 profile) and OpenID Connect ID tokens. They carry signed claims that can be verified without calling the authorization server.

Signing Algorithms

  • RS256 — RSA PKCS#1 v1.5 with SHA-256 (primary, used for access tokens and ID tokens)
  • HS256 — HMAC with SHA-256 (used for internal service tokens)
  • ES256 — ECDSA with P-256 — not yet implemented
  • EdDSA — Ed25519 — not yet implemented

Standard Claims (Section 4.1)

  • iss — issuer
  • sub — subject (user or client identifier)
  • aud — audience
  • exp — expiration time
  • iat — issued at time
  • jti — unique JWT identifier
  • nbf — not before (included in introspection responses)

JOSE Header Fields

  • alg — signing algorithm
  • typ — token type (JWT or at+jwt for access tokens)
  • kid — key identifier for key rotation support

Validation

  • Signature verification using JWKS (kid lookup)
  • Expiration check (exp claim)
  • Type header (typ) validation
  • none algorithm rejected (unsigned JWTs not accepted)
  • nbf claim enforcement on inbound tokens — not enforced
  • JWE (encrypted JWT) — not supported

Access Token Profile

Access tokens follow the JWT Profile for OAuth 2.0 Access Tokens (at+jwt type), with client, scope, and user claims embedded in the payload.