Authentication and Authorization Patterns

Reference for implementing authentication in web, mobile, and API applications.

1. JWT (JSON Web Tokens)

Structure

Three Base64URL-encoded parts separated by dots: header.payload.signature.

• Header -- algorithm (alg) and token type (typ).
• Payload -- claims: sub, iat, exp, iss, aud, plus custom claims.
• Signature -- HMAC-SHA256 or RSA/ECDSA over header and payload.

Signing