RFC 7519: JSON Web Token (JWT)

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON…

Read RFC 7519 on the RFC Editor

Outgoing relationships (15 related RFCs)

Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 3986: Uniform Resource Identifier (URI): Generic Syntax
Normative reference — RFC 2046: Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types
Normative reference — RFC 4949: Internet Security Glossary, Version 2
Normative reference — RFC 20: ASCII format for network interchange
Normative reference — RFC 7159: The JavaScript Object Notation (JSON) Data Interchange Format
Normative reference — RFC 7515: JSON Web Signature (JWS)
Normative reference — RFC 7518: JSON Web Algorithms (JWA)
Normative reference — RFC 7516: JSON Web Encryption (JWE)
Informative reference — RFC 5226: Guidelines for Writing an IANA Considerations Section in RFCs
Informative reference — RFC 6838: Media Type Specifications and Registration Procedures
Informative reference — RFC 3339: Date and Time on the Internet: Timestamps
Informative reference — RFC 4122: A Universally Unique IDentifier (UUID) URN Namespace
Informative reference — RFC 3275: (Extensible Markup Language) XML-Signature Syntax and Processing
Informative reference — RFC 6755: An IETF URN Sub-Namespace for OAuth

Incoming relationships (48 related RFCs)

Updated by, Normatively referenced by — RFC 8725: JSON Web Token Best Current Practices
Updated by, Normatively referenced by — RFC 7797: JSON Web Signature (JWS) Unencoded Payload Option
Normatively referenced by — RFC 8225: PASSporT: Personal Assertion Token
Normatively referenced by — RFC 7662: OAuth 2.0 Token Introspection
Normatively referenced by — RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol
Normatively referenced by — RFC 8226: Secure Telephone Identity Credentials: Certificates
Normatively referenced by — RFC 7800: Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
Normatively referenced by — RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
Normatively referenced by — RFC 9200: Authentication and Authorization for Constrained Environments Using the OAuth 2.0 Framework (ACE-OAuth)
Normatively referenced by — RFC 9334: Remote ATtestation procedureS (RATS) Architecture
Normatively referenced by — RFC 9711: The Entity Attestation Token (EAT)
Normatively referenced by — RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
Normatively referenced by — RFC 9396: OAuth 2.0 Rich Authorization Requests
Normatively referenced by — RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)
Normatively referenced by — RFC 9781: A Concise Binary Object Representation (CBOR) Tag for Unprotected CBOR Web Token Claims Sets (UCCS)
Normatively referenced by — RFC 8935: Push-Based Security Event Token (SET) Delivery Using HTTP
Normatively referenced by — RFC 8936: Poll-Based Security Event Token (SET) Delivery Using HTTP
Normatively referenced by — RFC 9493: Subject Identifiers for Security Event Tokens
Normatively referenced by — RFC 9560: Federated Authentication for the Registration Data Access Protocol (RDAP) Using OpenID Connect
Normatively referenced by — RFC 9796: SIP Call-Info Parameters for Rich Call Data
Normatively referenced by — RFC 8176: Authentication Method Reference Values
Normatively referenced by — RFC 8292: Voluntary Application Server Identification (VAPID) for Web Push
Normatively referenced by — RFC 8688: A Session Initiation Protocol (SIP) Response Code for Rejected Calls
Normatively referenced by — RFC 8898: Third-Party Token-Based Authentication and Authorization for Session Initiation Protocol (SIP)
Normatively referenced by — RFC 9246: URI Signing for Content Delivery Network Interconnection (CDNI)
Normatively referenced by — RFC 9321: Signature Validation Token
Normatively referenced by — RFC 9447: Automated Certificate Management Environment (ACME) Challenges Using an Authority Token
Normatively referenced by — RFC 9448: TNAuthList Profile of Automated Certificate Management Environment (ACME) Authority Token
Normatively referenced by — RFC 9701: JSON Web Token (JWT) Response for OAuth Token Introspection
Normatively referenced by — RFC 9728: OAuth 2.0 Protected Resource Metadata
Normatively referenced by — RFC 9767: Grant Negotiation and Authorization Protocol Resource Server Connections
Normatively referenced by — RFC 9770: Notification of Revoked Access Tokens in the Authentication and Authorization for Constrained Environments (ACE) Framework
Normatively referenced by — RFC 9795: Personal Assertion Token (PASSporT) Extension for Rich Call Data
Normatively referenced by — RFC 9901: Selective Disclosure for JSON Web Tokens
Normatively referenced by — RFC 9932: Mutually Authenticating TLS in the Context of Federations
Normatively referenced by — RFC 9999: Remote ATtestation procedureS (RATS) Conceptual Message Wrapper (CMW)
Informatively referenced by — RFC 7517: JSON Web Key (JWK)
Informatively referenced by — RFC 8224: Authenticated Identity Management in the Session Initiation Protocol (SIP)
Informatively referenced by — RFC 8747: Proof-of-Possession Key Semantics for CBOR Web Tokens (CWTs)
Informatively referenced by — RFC 8707: Resource Indicators for OAuth 2.0
Informatively referenced by — RFC 7635: Session Traversal Utilities for NAT (STUN) Extension for Third-Party Authorization
Informatively referenced by — RFC 9126: OAuth 2.0 Pushed Authorization Requests
Informatively referenced by — RFC 9597: CBOR Web Token (CWT) Claims in COSE Headers
Informatively referenced by — RFC 7628: A Set of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth
Informatively referenced by — RFC 9278: JWK Thumbprint URI
Informatively referenced by — RFC 9470: OAuth 2.0 Step Up Authentication Challenge Protocol
Informatively referenced by — RFC 9475: Messaging Use Cases and Extensions for Secure Telephone Identity Revisited (STIR)
Informatively referenced by — RFC 7520: Examples of Protecting Content Using JSON Object Signing and Encryption (JOSE)