How JWT works

Information Exchange: JWTs are a good way of securely transmitting information between parties because they can be signed , which means you can be sure that the senders are who they say they are. Additionally, the structure of a JWT allows you to verify that the content hasn’t been tampered with.

To authenticate a user, a client application must send a JSON Web Token (JWT) in the authorization header of the HTTP request to your backend API . API Gateway validates the token on behalf of your API, so you don’t have to add any code in your API to process the authentication.

The tokens are designed to be compact, URL-safe, and usable especially in a web-browser single-sign-on (SSO) context. JWT claims can typically be used to pass identity of authenticated users between an identity provider and a service provider, or any other type of claims as required by business processes .