JWT typ Header
The typ (type) header parameter in a JWT or JOSE object declares the media type of the compact token. For JSON Web Tokens the common value is JWT, signaling that the payload contains JWT claims. Other JOSE objects may use different typ values. typ is optional in RFC 7515 and RFC 7519 and many libraries do not strictly require it, but including typ set to JWT helps intermediaries and debugging tools recognize the token format quickly. Because typ is only integrity-protected by the signature when present in the signed header, it should never be treated as an authorization decision by itself. Decode tools surface typ for operators, yet production authorization must still depend on verified signatures and claims rather than an unverified or decorative type hint.
Why It Matters
Misreading typ can confuse operators debugging tokens that look like JWTs but are other JOSE structures. Attackers sometimes craft unusual typ values hoping validators are overly permissive about token shape. Keep typ consistent with your issuer, verify signatures first, and base authorization on verified claims rather than typ alone. Document expected typ in your API standards so services reject surprising token shapes during security reviews, onboarding, and automated contract tests across every environment you operate.
Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Is typ required in every JWT?
No. RFC 7519 makes typ optional. Many issuers still set typ to JWT for clarity. Always verify the signature and claims regardless of typ.
Can typ replace alg checks?
No. typ only hints at the media type of the object. Authorization still requires verifying the signature with an allowlisted alg and checking iss, aud, and exp on the verified claims set.
What typ value should I use?
For standard signed JWTs use JWT. For nested or specialized JOSE objects follow the relevant profile, document the expected value, and reject surprising typ values in shared verify helpers.