132

I generated a JWT and there are some claims which I understand well, but there is a claim called kid in header. Does anyone know what it means?

I generated the token using auth0.com

1

2 Answers 2

161

kid is an optional header claim which holds a key identifier, particularly useful when you have multiple keys to sign the tokens and you need to look up the right one to verify the signature.

Once signed, a JWT is a JWS. Consider the definition from the RFC 7515:

4.1.4. "kid" (Key ID) Header Parameter

The kid (key ID) Header Parameter is a hint indicating which key was used to secure the JWS. This parameter allows originators to explicitly signal a change of key to recipients. The structure of the kid value is unspecified. Its value MUST be a case-sensitive string. Use of this Header Parameter is OPTIONAL.

When used with a JWK, the kid value is used to match a JWK kid parameter value.

4
  • 1
    So it means that kid parameter can be used with HS256 algorithm only? right?
    – Aman Gupta
    Commented Jan 18, 2021 at 10:17
  • this answer is objectively correct, but sometimes its useful to keep track of the wrong answers out there - github.com/distribution/distribution/issues/813
    – Dave Ankin
    Commented Aug 22, 2021 at 8:00
  • @AmanGupta What makes you think only HS256 has key-identifiers? Or that only HS256 use-cases require key lookup/identification?
    – Dai
    Commented Jun 23, 2023 at 0:32
  • Also good to mention rfc-editor.org/rfc/rfc7638 which is the standard some tools uses to calculate kid.
    – toppk
    Commented Jul 24, 2023 at 4:23
19

The kid (key ID) claim is an optional header claim, used to specify the key for validating the signature.

It is described here: http://self-issued.info/docs/draft-jones-json-web-token-01.html#ReservedHeaderParameterName

1
  • 16
    Documentation drafts shouldn't be used as reference when the final version of the documentation is available. The kid claim has been moved from the JWT to the JWS and JWE specifications. Commented May 9, 2017 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.