A small, URL-safe way to represent claims that need to be transferred between two parties is with JSON Web Tokens (JWT). The claims in a JWT can be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted because they are encoded as a JSON object that can be used as the plaintext of a JSON Web Encryption (JWE) structure or as the payload of a JSON Web Signature (JWS) structure.