JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted.
Let’s add JWT tokens to protect our API endpoints. Connecting services will supply their public keys, so we can validate their JWT tokens. We’ll use a configuration file to map tokens to local policies to restrict access to certain endpoints.