JSON Web Token (JWT)

Note

IETF specification defining the JSON Web Token (JWT), a compact means of representing claims, signed or encrypted, transferred between two parties.

Summary

Purpose

IETF RFC 7519 (May 2015) defines the JSON Web Token (JWT):

The “claims” (name-value pairs asserted about a subject) are encoded in a JSON object, which can be signed using a JSON Web Signature (JWS), protected by an authentication code or encrypted RFC 7519, Abstract RFC 7519, § 2. Terminology.

Who it applies to

The RFC itself imposes nothing under eIDAS. Three acts in the corpus refer to it.

• PID providers. They ensure that the person identification data (PID) issued comply with the annex to Implementing Regulation 2024/2977 Art. 3(3). In the SD-JWT VC format, the JWT claims nbf and exp, defined in the RFC, must express the technical validity period of the PID Annex.
• Wallet providers. They ensure that wallet unit attestations comply with Annex Ib to Implementing Regulation 2024/2979 Art. 6(2). Under that annex, the wallet instance attestation and the key attestation must each be a JWT as specified in the RFC, signed or sealed by the wallet provider by means of a compact JAdES baseline B signature Annex Ib.
• Member States (registration of relying parties). Member States implement wallet-relying party registration certificates in accordance with Annex V to Implementing Regulation 2025/848 Art. 8(2)(e). That annex provides that their data exchange format is signed in the JWT (RFC 7519) and CWT (RFC 8392) formats Annex V.

Key points

• Technical validity of the PID. nbf (not before) sets the time before which the token must not be accepted; exp (expiration time) the time on or after which it must no longer be accepted RFC 7519, § 4.1.5. "nbf" (Not Before) Claim RFC 7519, § 4.1.4. "exp" (Expiration Time) Claim. Their use is optional in the RFC RFC 7519, § 4.1.4. "exp" (Expiration Time) Claim; the act requires it for SD-JWT VC PID Annex.
• Date format. The value of these claims is a NumericDate: the number of seconds elapsed since 1 January 1970 at 00:00:00 UTC RFC 7519, § 2. Terminology.
• Maintaining the revocation status. The wallet instance attestation carries a client_status claim, and the key attestation a key_storage_status claim. Each contains an exp sub-field, a NumericDate as defined in the RFC, which indicates until when the provider will maintain the revocation status of the wallet instance (or of the WSCD or key storage) in the status list Annex Ib. The act states that the top-level exp of the attestation indicates when the attestation itself expires, and that it must not be read as the end of that period Annex Ib.
• Link with OpenID4VCI. The wallet instance attestation is also a wallet attestation as specified in Appendix E of the OpenID4VCI specification, extended by the annex; the key attestation follows its Appendix D Annex Ib.

Clauses referred to by the acts

• nbf and exp claims, without a clause number: Implementing Regulation 2024/2977 Annex.
• Definition of the JWT and of NumericDate, without a clause number: Annex Ib to Implementing Regulation 2024/2979 Annex Ib.
• General reference: Annex V to Implementing Regulation 2025/848 Annex V.
• Implementing Regulation 2026/1731 replaced the annex to Implementing Regulation 2024/2977; it also replaced paragraphs 1 and 2 of Article 6 of Implementing Regulation 2024/2979 and added its Annex Ib Implementing Regulation (EU) 2026/1731; this summary cites the consolidated versions that incorporate these changes.

Links

• Acts that refer to it: Implementing Regulations 2024/2977 Implementing Regulation (EU) 2024/2977 — consolidated version of 11/08/2026, 2024/2979 Implementing Regulation (EU) 2024/2979 — consolidated version of 11/08/2026 and 2025/848 Implementing Regulation (EU) 2025/848 — consolidated version of 11/08/2026.
• Related standards: RFC 7515, JWS RFC 7515; RFC 7800, cnf claim RFC 7800; RFC 8392, CWT RFC 8392; OpenID4VCI 1.0 OpenID4VCI 1.0.
• Learning path: step 3, the European wallet.

Written by Asphalia.