JSON Web Token (JWT) represents claims to be transferred between two parties. JWT is a compact token format intended for space- constrained environments such as HTTP Authorization headers and URI query parameters. A JSON object is digitally signed using a JSON Web Signature (JWS) and optionally encrypted using JSON Web Encryption (JWE).

The claims in a JWT are encoded as a JSON object that is base64url encoded and consists of zero or more name/value pairs (or members), where the names are strings and the values are arbitrary JSON values. Each member is a claim represented by the JWT.

The JWT is represented as the concatenation of three segments:

• JWT Header Segment describes the cryptographic operations applied to the token.

• JWT Claim Segment encodes the claims contained in the JWT.

• JWT Crypto Segment contains the cryptographic material that secures the contents of the token.

The segments are separated by period ('.') characters. All three segments are always Base64url encoded values.

Creating the JWT token involves creating the object itself, then setting header and claim parameters as needed.

1. To create a JWT token, begin by using the constructor method JwtToken() to create a JwtToken object.

   JwtToken jwtToken = new JwtToken(); 
   

   You can use various setter methods to set the parameter values of the JWT token.

2. To set header parameters, the header parameter alg must first be set; use the setAlgorithm(String) and getAlgorithm() methods, respectively, to set and get this parameter. By default, the alg parameter is set to "none" implying that you do not want to sign the token.

   Use the setHeaderParameter(String, Object) method to set a user-defined header parameter in the JWT header segment.

3. Oracle JSON Web Token provides methods to set claim parameters exp, iat, iss, aud, prn. All the claim parameters are optional.

   Use the setClaimParameter(String, Object) method to set the user-defined claim parameter in the JWT claim segment.

Signing a token involves actions such as creating a token instance, setting token parameters, and finally signing the token.

1. Create and sign the JWT token, by first creating the instance of the JwtToken class:

   JwtToken jwtToken = new JwtToken(String); 
   

2. Next set the parameters like algorithm, issuer, expiry time, other claims and so on:

   jwtToken.setAlgorithm(JwtToken.SIGN_ALGORITHM.HS256.toString());
   jwtToken.setType(JwtToken.JWT);
   jwtToken.setIssuer("my.company.com");
   jwtToken.setPrincipal("john.doe"); 
   

3. Finally obtain the private key and sign the token with a secret key or private key:

   PrivateKey privateKey ;
   String jwtString = jwtToken.signAndSerialize(privateKey);
   

Verifying a token involves actions such as reading the token from the HTTP header, checking the token issuer, and so on.

// Read the JWT token as a String from HTTP header
String jwtStr = "eyJ.eyJp.dB";
JwtToken token = new JwtToken(jwtStr);
 
// Validate the issued and expiry time stamp.
if (token.getExpiryTime().after(new Date())) {
...
...
}
 
// Get the issuer from the token
String issuer = token.getIssuer(); 

If the JWT token is not required to be digitally signed, you can serialize the token without signing.

JwtToken jwtToken = new JwtToken();
jwtToken.setType(JwtToken.JWT);
jwtToken.setIssuer("my.example.com");
jwtToken.setPrincipal("john.doe");
String jwtString = jwtToken.serializeUnsigned();