> May be worth mentioning--JWTs are not part of the OAuth /OIDC standard. JWTs are a part of the OIDC standard; from the standard itself[1], > The primary ext

> May be worth mentioning--JWTs are not part of the OAuth /OIDC standard. JWTs are a part of the OIDC standard; from the standard itself[1], > The primary extension that OpenID Connect makes to OAuth 2.0 to enable End-Users to be Authenticated is the ID Token data structure. The ID Token is a security token that contains Claims about the Authentication of an End-User by an Authorization Server when using a Client, and potentially other requested Claims. The ID Token is represented as a JSON Web Token (JWT) [JWT]. But your comment sounds like you're conflating OAuth & OIDC. (It is true for OAuth that you're not required to use JWTs.) [1]: https://openid.net/specs/openid-connect-core-1_0.html#IDToken https://openid.net/specs/openid-connect-core-1_0.html#IDToke...