May 2015
JWT standardized
RFC 7519 defined JSONJavaScript Object Notation — a lightweight text format for structured data exchange on the web. Web Tokens in May 2015 — a compact, URLUniform Resource Locator — the address that identifies a resource on the web.-safe format for signed claims between services.
What it was for
JWTs encode JSONJavaScript Object Notation — a lightweight text format for structured data exchange on the web. claims in a three-part base64 string: header, payload, signature. APIs issue them after login; clients send `Authorization: Bearer <token>` on later requests. Used with OAuthAn authorization framework — lets apps access user data without sharing passwords. 2.0, OpenID ConnectAn identity layer on OAuth 2.0 — standardized login with ID tokens and user profiles., and microservice auth — though teams must validate signatures, expiry, and audience carefully.
Companies
- IETF
Why it's here
JWT became the default wire format for stateless APIApplication programming interface — a defined way for programs to talk to each other or to a service. authentication after OAuthAn authorization framework — lets apps access user data without sharing passwords. took off.
Why it mattered
It standardized how services pass identity and permissions without server-side sessions.
What it solved
Every APIApplication programming interface — a defined way for programs to talk to each other or to a service. invented its own opaque token format; clients and gateways needed a portable standard.
Media
- ImageJSON Web Token
Douglas Crockford, Public domain, via Wikimedia Commons
Related
- OAuth 2.0 standardizedOctober 2012
- TLS 1.0 standardizedJanuary 1999
- REST architectural style defined2000
- OpenID Connect 1.0 publishedFebruary 25, 2014