JSON Web Token (JWT)

A JSON Web Token (JWT) is a compact token format that carries claims such as a user identifier, role, issuer, audience, and expiration time. A server signs the token so another service can verify that its contents were not modified.

JWTs are commonly used for API authentication, but a valid signature does not make every token safe. Applications must verify the expected signing algorithm, issuer, audience, and expiration on every request. Short lifetimes, secure key rotation, and explicit authorization checks reduce the impact of token theft.

In DeFi admin systems, exposed signing secrets or weak claim validation can turn a frontend compromise into privileged API access. JWT secrets must never be shipped in browser code, committed to public repositories, or reused across environments.