What is JWT?

JWT Explained

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are digitally signed using a secret (HMAC) or public/private key pair (RSA/ECDSA), making them verifiable and trustworthy. A JWT contains three parts: a header (algorithm and token type), a payload (claims/data), and a signature. JWTs are the dominant authentication method for modern APIs because they're stateless—the server doesn't need to store session data. At M3L Software, we implement JWT authentication in virtually every API we build. Our implementations include refresh token rotation, token blacklisting, role-based access control, and secure token storage practices.

Key Features

Common Use Cases

Code Example

from fastapi import FastAPI, Depends, HTTPException
from fastapi.security import HTTPBearer
import jwt
from datetime import datetime, timedelta

SECRET_KEY = "your-secret-key"
ALGORITHM = "HS256"

app = FastAPI()
security = HTTPBearer()

def create_token(user_id: int) -> str:
    payload = {
        "sub": user_id,
        "exp": datetime.utcnow() + timedelta(hours=24),
        "iat": datetime.utcnow()
    }
    return jwt.encode(payload, SECRET_KEY, algorithm=ALGORITHM)

def verify_token(credentials = Depends(security)):
    try:
        payload = jwt.decode(
            credentials.credentials, SECRET_KEY, algorithms=[ALGORITHM]
        )
        return payload["sub"]
    except jwt.ExpiredSignatureError:
        raise HTTPException(status_code=401, detail="Token expired")

@app.get("/protected")
async def protected_route(user_id: int = Depends(verify_token)):
    return {"message": f"Hello user {user_id}"}

JWT authentication implementation in FastAPI. The create_token function generates signed tokens with expiration, and verify_token validates them as a dependency that can be injected into any route.

Frequently Asked Questions

Related Terms