RFC 9068 - JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
Published: October 2021
Status: Standards Track
Author: V. Bertocci (Auth0)
Abstract
This specification defines a profile for issuing OAuth 2.0 access tokens in JSON Web Token (JWT) format. Authorization servers and resource servers from different vendors can leverage this profile to issue and consume access tokens in an interoperable manner.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at ````https://www.rfc-editor.org/info/rfc9068\````.
Table of Contents
- 1. Introduction
- 1.1 Requirements Notation and Conventions
- 1.2 Terminology
- 2. JWT Access Token Header and Data Structure
- 2.1 Header
- 2.2 Data Structure
- 2.2.1 Authentication Information Claims
- 2.2.2 Identity Claims
- 2.2.3 Authorization Claims
- 2.2.3.1 Claims for Authorization Outside of Delegation Scenarios
- 3. Requesting a JWT Access Token
- 4. Validating JWT Access Tokens
- 5. Security Considerations
- 6. Privacy Considerations
- 7. IANA Considerations
- 7.1 Media Type Registration
- 7.1.1 Registry Content
- 7.2 Claims Registration
- 7.2.1 Registry Content
- 7.2.1.1 Roles
- 7.2.1.2 Groups
- 7.2.1.3 Entitlements
- 7.2.1 Registry Content
- 7.1 Media Type Registration
- 8. References
- 8.1 Normative References
- 8.2 Informative References
- Acknowledgements
- Author's Address
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (````https://trustee.ietf.org/license-info\````) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
Resources
- Official Text: RFC 9068
- Official Page: RFC 9068 DataTracker
- Errata: RFC Editor Errata