How is a JWT characterized in the context of REST API security?

A JSON Web Token (JWT) is an encoded JSON token primarily used for authentication. When a user successfully logs in, the server issues a JWT, which the client then sends with subsequent requests to prove its identity. This token contains claims (information about the user and the token itself) that can be verified by the server. While JWTs are often used to carry authorization information (like user roles or permissions), their fundamental characteristic is to authenticate the sender. JWTs are typically encoded (Base64Url), not encrypted, meaning their content can be read by anyone, but they are signed to ensure their integrity and authenticity. Therefore, "encrypted" is incorrect, and while they can carry authorization data, their core function is authentication.