JWT & OAuth 2.0 Syntax Cheat Sheet

Quick reference guide for JWT & OAuth 2.0: Structure, authorization code grant + PKCE, client credentials, and claims.

Security Tools
jwt
oauth2
auth

JSON Web Tokens (JWT) and OAuth 2.0 provide standardized authentication and authorization frameworks for web applications and APIs.

JWT Token Structure

A JWT consists of three Base64URL-encoded parts separated by dots (.): header.payload.signature

text
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Standard Registered JWT Claims

Table
Claim KeyNamePurpose / Example Value
issIssuerPrincipal issuing token ("https://auth.example.com")
subSubjectUser or principal ID ("user_123")
audAudienceRecipient target for token ("https://api.example.com")
expExpiration TimeUnix timestamp after which token is invalid (1750000000)
nbfNot BeforeUnix timestamp before which token must not be accepted
iatIssued AtUnix timestamp when token was created
jtiJWT IDUnique identifier for the token (nonce/replay protection)

OAuth 2.0 Grant Types Summary

Table
Grant TypeBest Use CaseFlow Overview
Authorization Code + PKCESPA & Mobile AppsUser logs in in browser -> Auth code returned -> Exchanged for Tokens with Code Verifier
Client CredentialsServer-to-Server APIsBackend server authenticates with client_id & client_secret directly
Refresh TokenToken RenewalExchange long-lived refresh_token for new short-lived access_token

Authorization Code + PKCE Parameters

http
# 1. Authorization Request
GET /authorize?
  response_type=code
  &client_id=my_client_id
  &redirect_uri=https://app.example.com/callback
  &scope=openid%20profile%20email
  &state=xyz123
  &code_challenge=E9Mel-pFxB-FGRW4BztRPRGgCKEsp3_A
  &code_challenge_method=S256

# 2. Token Exchange Request
POST /oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=my_client_id
&code=SplxlOBeZQQYbYS6WxSbIA
&redirect_uri=https://app.example.com/callback
&code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

Common Pitfalls & Tips

[!WARNING] Never store sensitive private keys or plain passwords inside JWT payloads! JWT payloads are Base64 encoded, not encrypted, and can be read by anyone.

[!TIP] Always enforce algorithm verification on the backend to prevent alg: "none" token forgery attacks.

Related tools

JWT Decoder & InspectorJWT Signer & Verifier