JWT tokens

What's inside a JWT

A JWT (JSON Web Token) is a compact, signed string with three parts joined by dots: header.payload.signature.

• Header — which algorithm signed it.
• Payload — the claims: who this token is for (sub, short for subject) plus timing (iat issued-at, exp expiry). Anyone can read the payload — it's only base64, not encrypted.
• Signature — the server signs header + payload with a secret key. Change one character of the payload and the signature no longer matches, so tampering is detectable.

This is the exact string Part I's iOS app received from /auth/signup and /auth/login and stored in the Keychain. Every request after that sent it back in an Authorization: Bearer <token> header — that token came from exactly the function below.