JWT Lifecycle & Stateless Verification 11 Steps

How HMAC/RSA cryptographic signatures enable zero-DB-lookup API verification, tamper detection & refresh rotation

Step 1 of 11

OIDC Auth ↔ Signed JWT

Bearer JWT ↔ 200/401 API

SQL Hash ↔ Token Ledger

COMPONENT INSPECTOR Click any node

Client App (SPA / Mobile)

Current state: Unauthenticated

WHAT THIS COMPONENT IS DOING NOW

Collecting user credentials and initiating POST /login over TLS to the Identity Provider.

WHY THIS COMPONENT MATTERS

Holds short-lived JWT access tokens in memory/HttpOnly storage and attaches them as Bearer headers on every API call.

HOW THIS COMPONENT WORKS WITH THE REST OF THE SYSTEM

Authenticates against the Auth Server once, presents the signed JWT to the Resource Server, and rotates via Refresh Token when expired.

LIVE JWT WIRE ANATOMY UNSIGNED

Header: {"alg":"HS256","typ":"JWT"}

Payload: {"sub":"123","role":"editor"}

Signature: HMACSHA256(b64(H)+"."+b64(P), secret)