JSON Web Token (JWT)
A compact, self-contained, signed JSON structure that carries claims directly in the token itself — the workhorse format behind most modern access and ID tokens.
aka: JWT
Being self-contained is a JWT’s whole trade-off: validation is fast and doesn’t require a round trip, but revoking one before it expires means either keeping it short-lived or maintaining a denylist — you can’t just delete a database row the way you can with an opaque, server-side session token. Checking the signature, issuer, audience, and expiry on every single JWT is not optional; skipping any one of them is the security hole.