Glossary
JWT (JSON Web Token)
A compact, digitally signed token that securely carries claims about a user or client, widely used for stateless authentication and authorization in APIs and real-time apps.
General definition
A JWT, or JSON Web Token, is a compact, URL-safe token that packages a set of claims, statements such as who the user is and what they are allowed to do, and signs them so they cannot be tampered with. A JWT has three parts separated by dots:
- Header, the token type and signing algorithm
- Payload, the claims, such as user id, roles and an expiry time
- Signature, a cryptographic signature over the header and payload
Because the signature lets a server verify a token without looking anything up, JWTs enable stateless authentication: the token itself proves the request is legitimate. The payload is signed but not secret, so it should never contain sensitive data, and tokens should always carry a short expiry.
How JWTs are used
In a typical flow, a user signs in, the server issues a JWT, and the client sends that token with every following request, often in an Authorization header. APIs, WebSocket connections and single sign-on systems all use JWTs to carry identity between services without a shared session store.
JWT in the Ethora ecosystem
Ethora uses token-based authentication so client apps and the backend can verify identity across chat, calls and API calls, including for real-time XMPP connections. Developers integrate auth, including social sign-on, through the SDKs rather than building a token system from scratch. See the Chat SDK and API.
