JSON Web Token

Signed claims in a URL-safe string — and the ways it goes wrong.

15 capabilities 6 sections reference specification

Build against it

# give your agent the catalog — no account, no install
claude mcp add provespec -- npx -y provespec-mcp

# then, from any agent session
spec_get(slug: "jwt")                → the capability tree
spec_checklist(slug: "jwt")          → the questions to answer
spec_grade(slug: "jwt", grades: [...])  → parity % + the gap list

# or just fetch it
curl https://provespec.com/catalog/jwt/spec.json

Grade every capability below as yes · partial · no · na, with a file reference as evidence. Whatever you leave ungraded counts as missing — the gap list is the work queue.

Or just paste this to your agent

Use the ProveSpec MCP server. Fetch the "jwt" spec with
spec_get, then walk spec_checklist and grade this repository against it —
one verdict per capability, each with a file reference as the note.
Call spec_grade with the results and give me the gap list as the plan.

If the server is not registered, add it first:
  claude mcp add provespec -- npx -y provespec-mcp

The specification

Structure 3

✓ Three base64url segments joined by dots header.payload.signature
✓ Header declares alg and typ
✓ Payload is a JSON claims set

Claims 2

✓ Registered claims iss, sub, aud, exp, nbf, iat, jti
✓ Custom claims namespaced to avoid collision

Signing 2

✓ HMAC with a shared secret HS256
✓ Asymmetric signatures RS256, ES256 verify with the public key

Verification 4

✓ Signature checked before any claim is read the cardinal rule
✓ alg is never taken from the token alone reject "none" and algorithm confusion
✓ exp and nbf enforced with a bounded clock skew
✓ aud and iss checked against expectation

Key management 2

✓ Key rotation via kid and a JWKS endpoint
✓ Keys cached with a documented refresh policy

Operational 2

✓ Revocation strategy stated short expiry, denylist, or refresh tokens
✓ Tokens are not used as a session store size and staleness consequences understood

Download spec.json All 53 specs