JWT authentication

Claims constitute the payload part of a JSON web token and represent a set of information exchanged between two parties . The JWT standard distinguishes between reserved claims, public claims, and private claims. In API Gateway context, both public claims and private claims are considered custom claims.

There are two parties involved in an access token request: the client, who requests the token, and the resource (the API) that accepts the token when the API is called. The aud claim in a token indicates the resource the token is intended for (its audience) .

Open the Certificates tab to see the Public Key in the Signed Certificate field . To use the Public Key to verify a JWT signature on JWT.io, copy the Public Key and past it in the Public Key or Certificate field under Verify Signature section on the JWT.io website.

The jti (JWT ID) claim provides a unique identifier for the JWT . The identifier value MUST be assigned in a manner that ensures that there is a negligible probability that the same value will be accidentally assigned to a different data object. The jti claim can be used to prevent the JWT from being replayed.