RFC 9068: JWT Profile for OAuth 2.0 Access Tokens

datatracker.ietf.org/doc/html/rfc9068

The JWT Access Token profile describes a way to encode access tokens as a JSON Web Token, including a set of standard claims that are useful in an access token.

JWTs can be used as OAuth 2.0 Bearer Tokens to encode all relevant parts of an access token into the access token itself instead of having to store them in a database.

Related Specs:

• OAuth 2.0 Bearer Token Usage (RFC 6750)
• Token Introspection (RFC 7662)
• Token Revocation (RFC 7009)
• JSON Web Token (RFC 7519)

More resources

• Self-Encoded Access Tokens (oauth.com)
• jsonwebtoken.io
• JSON Web Tokens (JWT) in Auth0 (auth0.com)
• Create and Verify JWTs in PHP (developer.okta.com)
• From Idea to Standard: How the JWT Profile for OAuth 2.0 Access Tokens Became RFC9068 by Vittorio Bertocci