RFC 9068: JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens
In plain English — editorial summary, not part of the RFC
This specification defines a profile for issuing OAuth 2.0 access tokens in JSON Web Token (JWT) format. Authorization servers and resource servers from different vendors can leverage this profile to issue and consume access tokens in an interoperable manner.
Document record
- Document ID
- RFC9068
- Published
- October 2021
- Authors
- V. Bertocci
- Status
- PROPOSED STANDARD
- Stream
- IETF
- Area
- sec
- Pages
- 15
- Also known as
- —
Topics
Related documents
Ranked automatically by shared keywords, IETF area and stream — not by editorial selection.
- RFC 9101The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR)Current
August 2021
- RFC 9202Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE)Updated
August 2022
- RFC 8707Resource Indicators for OAuth 2.0Current
February 2020
- RFC 9430Extension of the Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE) to Transport Layer Security (TLS)Current
July 2023
- RFC 8705OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access TokensCurrent
February 2020
- RFC 8693OAuth 2.0 Token ExchangeCurrent
January 2020
- RFC 8414OAuth 2.0 Authorization Server MetadataCurrent
June 2018
- RFC 9728OAuth 2.0 Protected Resource MetadataCurrent
April 2025
Also filed under
About this page
The document record above — title, authors, date, status, stream, area, relationships, DOI and errata — is imported verbatim from the public RFC Editor index. The “in plain English” section is editorial: written by The metasystema editorial team, not part of the RFC. Where the two differ, the RFC text governs.
Last checked against the RFC Editor index on . RFCs are never revised after publication; changes are issued as new documents.
Data sources · Editorial policy · Report a correction · What is an RFC?