Networked Media Open Specifications

JSON Web Tokens (JWT)

←Prerequisites · Index↑ · Authorization Server Setup→

Access Tokens

The format of the Access Token used by IS-10 is the JSON Web Tokens (JWT). JWT is an open industry standard method for representing claims securely between services (RFC 7519). The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure, enabling the claims to be digitally signed with RSASSA-PKCS1-v1_5 using SHA-512.

The Access Token consists of three segments, each being encoded separately using Base64url Encoding, and concatenated using periods to produce the JWT:

base64urlEncoding(header) + '.' + base64urlEncoding(payload) + '.' + base64urlEncoding(signature)

Example of a JWT:


JWTs can be straightforwardly introspected using tools such as the debugger.

The Header is used to identify which algorithm was used to generate the Signature. In accordance with IS-10, the alg field in the header is set to RS512.

  "alg": "RS512",
  "typ": "JWT"


The Payload contains the token claims, including when the token became active, when it is due to expire, who the token is intended for, and some other registered (standard) and private claims.

Registered Claims

The IS-10 specification gives details of how NMOS API Clients and Servers use registered claims.

Private Claims

IS-10 has defined some private claims which are used to control read/write access to APIs. These are configured in the Authorization Server and are covered in more detail in that section.


The Signature is created by encoding the Header and Payload using Base64url encoding, then run through the cryptographic algorithm specified in the Header with the issuer private key.

←Prerequisites · Index↑ · Authorization Server Setup→