What does an API need to validate before trusting a JWT?

Validate JWTs and trust claims carefully

Explains JWT validation, trusted issuers, audiences, expiration, signing keys, claims, and server-side authorization boundaries.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

The API should validate the JWT signature, issuer, audience, expiration, and signing key. It should also use the expected token type and algorithm. Only after validation should the API read claims like user id, roles, tenant, or scopes. A token string from the client is just input until those checks pass.

Full answer below

Practice focus

Issuer, audience, signature, expiry, signing keys, token type, claims trust, clock skew, and authorization use.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
A JWT is untrusted input until its signature and intended use have been validated. Issuer, audience, lifetime, algorithm, key, and token type define whether its claims can participate in an authorization decision.
The API should validate the JWT signature, issuer, audience, expiration, and signing key. It should also use the expected token type and algorithm. Only after validation should the API read claims like user id, roles, tenant, or scopes. A token string from the client is just input until those checks pass.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would be careful about what claims mean. A role or tenant claim may come from the identity provider, but resource ownership can still depend on application data. The API should not accept caller-supplied claims outside the signed token, and it should not trust a token intended for another audience. I would keep token lifetime short enough to reduce risk but long enough for normal user experience.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Decoding a JWT without verifying its signature.
Ignoring issuer or audience.
Trusting tenant or role values sent outside the token.
Using long-lived access tokens for convenience.

What does an API need to validate before trusting a JWT?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

Try a variant

Tech stacks

Skill areas

Suggest an improvement